Fix five confirmed bugs: typo, field name, auth, success message, debug print

- Fix `fist_name` typo in CSV bulk upload (first_name was always None)
- Fix CSV file field name mismatch: `members_data` → `csv_file` (matches form + template)
- Add `@login_required` to backend index view (was unprotected)
- Move `messages.success` inside `if form.is_valid()` (was always shown)
- Remove debug `print(response.headers)` from HTMXViewMixin

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/mixins.py

@@ -65,9 +65,7 @@ class HTMXViewMixin:
             if is_get and not is_pagination:
                 # Push the current path unless overridden
                 response.headers["HX-Push-Url"] = self.htmx_push_url or request.get_full_path()
-                
-            print(response.headers)
-            
+
         # Build HX-Trigger payload
         trigger_payload = {}