Add backups with S3, daily cost push, automation templates and a browser tool

- Daily backups (database + config) into <data_dir>/backups, keep N,
  optional upload to any S3-compatible bucket (SigV4, bucket pruning);
  settings panel with run-now, list and download
- Daily cost summary push at 20:00 (opt-in per user, preview button)
- Automations from templates (dependency check, security review, test
  health, daily summary, TODO report, docs freshness) via POST /jobs/create
- browser tool: headless Chromium over CDP – click, type, keys, waits,
  JavaScript, navigation, screenshots, console errors; requests to private
  network addresses are blocked (sub-resources and redirects included)
- Secrets masked in the config view: S3 secret key, metrics token
- Replace the remaining text arrows/refresh glyphs with SVG icons

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config.example.toml

@@ -46,6 +46,8 @@ currency = "USD"
 # Largest file upload in MB. Uploads are sent in 8 MB chunks, so the reverse
 # proxy's body limit (e.g. Nginx client_max_body_size) does not apply.
 max_upload_mb = 500
+# Bearer token for Prometheus at GET /metrics (empty = /metrics disabled).
+# metrics_token = "${CODECRAFT_METRICS_TOKEN}"
 
 
 # -----------------------------------------------------------------------------
@@ -189,6 +191,7 @@ diagnostics = "allow"
 openscad = "allow"     # renders .scad files to STL/3MF + previews
 remember = "allow"     # project memory (.codecraft/memory.md)
 browser_snapshot = "allow"
+browser = "ask"          # interactive browser (clicks, forms); private LAN is blocked
 image_compare = "allow"
 generate_image = "ask"   # costs money per image
 "mcp__*" = "ask"
@@ -358,6 +361,27 @@ enabled = true
 mode = "auto"
 
 
+# -----------------------------------------------------------------------------
+#  Backups
+# -----------------------------------------------------------------------------
+#  A zip with the database and this config, daily into <data_dir>/backups.
+#  The zip contains API keys: keep the bucket private.
+[backup]
+enabled = true
+hour = 3        # local time
+keep = 30       # local backups to keep
+
+# Optional copy to any S3-compatible storage (AWS, MinIO, Garage, B2, …).
+[backup.s3]
+endpoint = ""   # e.g. "https://s3.eu-central-1.amazonaws.com"
+region = ""
+bucket = ""
+prefix = "codecraft/"
+access_key = ""
+secret_key = "" # "${S3_SECRET_KEY}" keeps the key out of this file
+keep = 0        # backups to keep in the bucket (0 = all)
+
+
 # -----------------------------------------------------------------------------
 #  Craft mode
 # -----------------------------------------------------------------------------