fix(vpn): backport VPN fixes from production debugging

- Fix _commit_and_sync infinite recursion
- Use admin session for subnet_index allocation (bypass RLS)
- Auto-set VPN endpoint from CORS_ORIGINS hostname
- Remove server address field from VPN setup UI
- Add DELETE endpoint and button for VPN config removal
- Add wg-reload watcher for reliable config hot-reload via wg syncconf
- Add wg_status.json writer for live peer handshake status in UI
- Per-tenant SNAT for poller-to-device routing through VPN
- Restrict VPN→eth0 forwarding to Docker networks only (block exit node abuse)
- Use 10.10.0.0/16 allowed-address in RouterOS commands
- Fix structlog event= conflict (use audit=True)
- Export backup_scheduler proxy for firmware/upgrade imports

backend/app/services/backup_scheduler.py

@@ -195,3 +195,18 @@ async def stop_backup_scheduler() -> None:
         _scheduler.shutdown(wait=False)
         _scheduler = None
         logger.info("Backup scheduler stopped")
+
+
+class _SchedulerProxy:
+    """Proxy to access the module-level scheduler from other modules.
+
+    Usage: `from app.services.backup_scheduler import backup_scheduler`
+    then `backup_scheduler.add_job(...)`.
+    """
+    def __getattr__(self, name):
+        if _scheduler is None:
+            raise RuntimeError("Backup scheduler not started yet")
+        return getattr(_scheduler, name)
+
+
+backup_scheduler = _SchedulerProxy()