Fix migrations and deploy issues + errors + linting

- scan both pending/ and applied/ dirs so remote catch-up works
- fix remote 500s: run.php handles per-statement errors so VIEW rebuilds run after duplicate columns; replace mb_strimwidth with substr (no mbstring extension on server)
- add missing migration: 015_license_custom.sql (column existed in schema.sql but was never migrated)
- remote: fgetcsv enclosure single-char + AdminLogger permission-denied
guard + deploy always migrates
- fix admin-filters wrapping: restore flex-wrap, flex-basis on
inputs/selects, shrink-protect buttons
- fix phpstan: remove redundant ?? [] after isset guard in
ThesisEditController
- biome: exclude vendored min.js via includes patterns;
lint whole js dir; modernise beforeunload-guard.js

app/public/assets/js/beforeunload-guard.js

@@ -4,20 +4,19 @@
  * Attach to any form with a data-beforeunload-guard attribute.
  * No effect when JavaScript is unavailable (form posts normally).
  */
-(function () {
-    var forms = document.querySelectorAll('form[data-beforeunload-guard]');
+(() => {
+    const forms = document.querySelectorAll('form[data-beforeunload-guard]');
     if (!forms.length) return;
 
-    var dirty = false;
+    let dirty = false;
 
-    for (var i = 0; i < forms.length; i++) {
-        var form = forms[i];
-        form.addEventListener('input', function () { dirty = true; });
-        form.addEventListener('change', function () { dirty = true; });
-        form.addEventListener('submit', function () { dirty = false; });
+    for (const form of forms) {
+        form.addEventListener('input', () => { dirty = true; });
+        form.addEventListener('change', () => { dirty = true; });
+        form.addEventListener('submit', () => { dirty = false; });
     }
 
-    window.addEventListener('beforeunload', function (e) {
+    window.addEventListener('beforeunload', (e) => {
         if (dirty) {
             e.preventDefault();
         }