fix(backup): address code review feedback - accessibility, CSRF, docs, imports

- Move `import os` to top-level in app/views/backup.py
- Fix docstring in BackupRecord model to remove non-existent 'location' field
- Replace browser confirm() dialogs with accessible modal dialog (role=dialog, aria-modal, aria-labelledby)
- Add csrfToken() helper that validates token presence instead of silently falling back to empty string
- Fix aria-live region to remain in DOM (screen-reader friendly) rather than using x-show
- Add Backup & Restore section to docs/ConfigurationGuide.md with retention table
- Add backup env vars to .env.demo with comments

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/views/backup.py

@@ -3,6 +3,7 @@ Backup management dashboard view – admin only.
 """
 
 import logging
+import os
 
 from fastapi import Depends, HTTPException, Request, status
 from sqlalchemy.orm import Session
@@ -31,8 +32,6 @@ async def backup_dashboard(request: Request, db: Session = Depends(get_db)):
                 counts[r.backup_type] += 1
 
         # Compute total local size
-        import os
-
         total_size = sum(r.size_bytes for r in records if r.local_path and os.path.exists(r.local_path))
 
         return templates.TemplateResponse(