Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

justfile

@@ -97,7 +97,8 @@ deploy-deps:
             composer install --no-dev --no-interaction --optimize-autoloader && \
             sha256sum composer.lock | cut -d" " -f1 > vendor/.composer-lock-checksum; \
         else \
-            echo "→ composer.lock unchanged, skipping composer install"; \
+            echo "→ composer.lock unchanged, dumping autoloader (new classes may exist)…"; \
+            composer dump-autoload --optimize --no-interaction; \
         fi'
 
 [group('deploy')]