Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

nginx/xamxam.conf.reference

@@ -113,12 +113,8 @@ server {
         deny all;
     }
 
-    # Admin panel - password protected
+    # Admin panel - password protected at the PHP layer (AdminAuth)
     location ^~ /admin/ {
-        # HTTP Basic Authentication (first layer)
-        auth_basic "Admin Access - Post-ERG";
-        auth_basic_user_file /etc/nginx/.htpasswd-xamxam;
-
         # Rate limiting for admin
         limit_req zone=admin burst=5 nodelay;