fix: backend controllers - allow GET for create/update actions
mod: building form (default for image, masked input for cost_time)