docs: update export/import documentation

- Clarify that session auth (password login) is sufficient for export/import
- Document that guest metadata and custom console URLs are included
- Update FAQ with clearer backup instructions
- Add UI-first approach to README backup section

README.md

@@ -198,6 +198,13 @@ Environment="FRONTEND_PORT=8080"
 
 ### Backup/Restore
 
+**Via UI (recommended):**
+- Settings → Security → Backup & Restore
+- Export: Choose login password or custom passphrase for encryption
+- Import: Upload backup file with passphrase
+- Includes all settings, nodes, and custom console URLs
+
+**Via CLI:**
 ```bash
 # Export (v4.0.3+)
 pulse config export -o backup.enc
@@ -206,8 +213,6 @@ pulse config export -o backup.enc
 pulse config import -i backup.enc
 ```
 
-Or use Settings → Security tab in UI.
-
 ## Updates
 
 ### Docker

docs/API.md

@@ -219,14 +219,19 @@ DELETE /api/system/api-token/delete # Remove token
 ```
 
 ### Export/Import Configuration
-Backup and restore Pulse configuration.
+Backup and restore Pulse configuration with encryption.
 
 ```bash
 POST /api/config/export  # Export encrypted config
 POST /api/config/import  # Import encrypted config
 ```
 
-**Note**: Requires API_TOKEN or ALLOW_UNPROTECTED_EXPORT=true
+**Authentication**: Requires one of:
+- Active session (when logged in with password)
+- API token via X-API-Token header
+- ALLOW_UNPROTECTED_EXPORT=true (for unprotected instances)
+
+**Export includes**: All nodes, credentials (encrypted), alerts, webhooks, email config, system settings, and guest metadata (custom console URLs)
 
 ## Notifications
 

docs/FAQ.md

@@ -32,7 +32,10 @@ API tokens are more secure. Create in Proxmox: Datacenter → Permissions → AP
 See [Configuration Guide](CONFIGURATION.md) for details
 
 ### How do I backup my configuration?
-Settings → Security → Export Configuration (requires API token or ALLOW_UNPROTECTED_EXPORT=true)
+Settings → Security → Backup & Restore → Export Backup
+- If logged in with password: Just enter your password or a custom passphrase
+- If using API token only: Provide the API token when prompted
+- Includes all settings, nodes, credentials (encrypted), and custom console URLs
 
 ### Can Pulse detect Proxmox clusters?
 Yes! When you add one cluster node, Pulse automatically discovers and monitors all nodes

docs/SECURITY.md

@@ -282,7 +282,7 @@ This checks:
 
 ## Troubleshooting
 
-**Export blocked?** Set API_TOKEN or ALLOW_UNPROTECTED_EXPORT=true
+**Export blocked?** Login with password, set API_TOKEN, or set ALLOW_UNPROTECTED_EXPORT=true
 **Rate limited?** Wait 1 minute and try again
 **Can't login?** Check PULSE_AUTH_USER and PULSE_AUTH_PASS environment variables
 **API access denied?** Verify API_TOKEN is correct (use original token, not hash)