Add description input and business context support to demo app

[melonattacker]

This pull request adds support for natural-language system descriptions as a new input type to the Threat Thinker demo app and backend, allowing users to generate threat analyses starting from a textual description rather than a diagram. It also introduces an optional business context field to further inform threat inference, updates configuration and documentation, and improves the frontend UI for clarity and internationalization.

Major new features:

• Added support for description (natural-language system description) as a valid input type throughout the demo app, backend API, and configuration files, enabling users to start threat analysis without a diagram. [1] [2] [3]
• Introduced an optional "business context" field in the UI and proxy, which is sent to the backend as an additional context file to influence the threat analysis. [1] [2] [3] [4] [5]

Documentation and configuration updates:

• Updated documentation (docs/serve_config.md) and example configs to document the new description input type, explain its behavior, and show how to enable it in allowed_inputs. [1] [2] [3] [4]
• Expanded the demo app README to describe the new input types and business context feature. [1] [2]

Frontend and UI improvements:

• Enhanced the frontend UI to support the new input type, provide dynamic labels and placeholders, improved default content, and clarified terminology (e.g., "Diagram Input" → "Analysis Input"). Added Japanese font support and improved accessibility. [1] [2] [3] [4] [5] [6]

Backend and API enhancements:

• Allowed .txt, .md, and .markdown file extensions to be autodetected as the new description input type in backend API input detection.
• Added support for returning DFD sidecar JSON files when using the description input type and requesting the dfd report format. [1] [2]

Bug fixes and minor improvements:

• Improved error messages and input validation for the new input types and business context field.
• Fixed a bug in threat inference where RAG sources could be incorrectly processed when RAG context was not present.