[Enhancement] Accessibility: native confirm() audit on data-confirm forms

What

The platform standard is to use the branded App.modal.confirm() helper instead of native browser confirm(). Several destructive-action forms still carry a data-confirm attribute that falls through to native if JS does not load. This sweep audits and rewrites them to use the modal helper exclusively.

Where it lives

• Surface: every page with a destructive form (delete, ban, revoke, etc.)
• Backlog id: B-A11Y-1

Implementation notes

• grep for data-confirm across templates/
• Replace bare native fallback paths with a dedicated confirmation route or guaranteed inline modal
• Standing memory: native confirm() / alert() / prompt() banned anywhere on the platform

Tracked as B-A11Y-1 in docs/BACKLOG.md.