Add backups with S3, daily cost push, automation templates and a browser tool

- Daily backups (database + config) into <data_dir>/backups, keep N,
  optional upload to any S3-compatible bucket (SigV4, bucket pruning);
  settings panel with run-now, list and download
- Daily cost summary push at 20:00 (opt-in per user, preview button)
- Automations from templates (dependency check, security review, test
  health, daily summary, TODO report, docs freshness) via POST /jobs/create
- browser tool: headless Chromium over CDP – click, type, keys, waits,
  JavaScript, navigation, screenshots, console errors; requests to private
  network addresses are blocked (sub-resources and redirects included)
- Secrets masked in the config view: S3 secret key, metrics token
- Replace the remaining text arrows/refresh glyphs with SVG icons

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/i18n/de.ts

@@ -463,6 +463,34 @@ export const de: Messages = {
   "sidebar.moveHintExisting": "Vorhandene Ordner: {folders}. Gib einen davon oder einen neuen Namen ein.",
   "sidebar.folderName": "Ordnername",
   "sidebar.move": "Verschieben",
+  "backup.now": "Jetzt sichern",
+  "backup.running": "Sichere…",
+  "backup.created": "Backup {file} erstellt.",
+  "backup.s3Failed": "Backup erstellt, aber der S3-Upload ist fehlgeschlagen",
+  "backup.daily": "Automatisch täglich sichern",
+  "backup.at": "um",
+  "backup.oclock": "Uhr",
+  "backup.keep": "behalten:",
+  "backup.s3": "In einen S3-Bucket kopieren (optional)",
+  "backup.s3Hint": "Jeder S3-kompatible Speicher funktioniert (AWS, MinIO, Garage, Backblaze B2, Hetzner …). Schlüssel dürfen ${ENV}-Verweise sein. Das Backup enthält die Config mit API-Keys – nur einen privaten Bucket verwenden.",
+  "backup.endpoint": "Endpunkt",
+  "backup.region": "Region",
+  "backup.bucket": "Bucket",
+  "backup.prefix": "Präfix",
+  "backup.accessKey": "Access Key",
+  "backup.secretKey": "Secret Key",
+  "backup.secretStored": "gespeichert – leer lassen zum Behalten",
+  "backup.s3Keep": "Im Bucket behalten (0 = alle)",
+  "backup.last": "Letztes Backup",
+  "backup.s3Ok": "hochgeladen",
+  "jobs.fromTemplate": "Neue Automation aus Vorlage",
+  "jobs.tplName": "Name",
+  "jobs.tplProject": "Projektordner",
+  "jobs.tplSchedule": "Wann",
+  "jobs.tplCronHint": "Cron: Minute Stunde Tag Monat Wochentag (Zeitzone des Servers).",
+  "jobs.tplMode": "Modus",
+  "jobs.tplPrompt": "Aufgabe für den Agenten",
+  "jobs.tplCreate": "Automation anlegen",
   "new.title": "Neue Session",
   "new.directory": "Projektverzeichnis",
   "new.up": "Hoch",
@@ -570,6 +598,8 @@ export const de: Messages = {
   "settings.notifications": "Benachrichtigungen",
   "settings.notificationsEnable": "Aktivieren",
   "settings.notificationsOn": "Aktiv",
+  "settings.digest": "Tägliche Kostenübersicht um 20:00",
+  "settings.digestNow": "Heutige Übersicht jetzt senden",
   "settings.pushTest": "Test senden",
   "settings.pushTestSent": "Testbenachrichtigung gesendet",
   "settings.pushTestNone": "Kein Gerät angemeldet",
@@ -702,6 +732,7 @@ export const de: Messages = {
 
   "common.ok": "OK",
   "common.cancel": "Abbrechen",
+  "common.refresh": "Aktualisieren",
   "nav.logout": "Abmelden",
   "login.username": "Benutzername",
   "login.password": "Passwort",

web/src/i18n/en.ts

@@ -462,6 +462,34 @@ export const en = {
   "sidebar.moveHintExisting": "Existing folders: {folders}. Type one of them or a new name.",
   "sidebar.folderName": "Folder name",
   "sidebar.move": "Move",
+  "backup.now": "Back up now",
+  "backup.running": "Backing up…",
+  "backup.created": "Backup {file} created.",
+  "backup.s3Failed": "Backup created, but the S3 upload failed",
+  "backup.daily": "Automatic daily backup",
+  "backup.at": "at",
+  "backup.oclock": "o'clock",
+  "backup.keep": "keep",
+  "backup.s3": "Copy to an S3 bucket (optional)",
+  "backup.s3Hint": "Any S3-compatible storage works (AWS, MinIO, Garage, Backblaze B2, Hetzner …). Keys may be ${ENV} references. The backup contains the config with API keys – use a private bucket.",
+  "backup.endpoint": "Endpoint",
+  "backup.region": "Region",
+  "backup.bucket": "Bucket",
+  "backup.prefix": "Prefix",
+  "backup.accessKey": "Access key",
+  "backup.secretKey": "Secret key",
+  "backup.secretStored": "stored – leave empty to keep",
+  "backup.s3Keep": "Keep in bucket (0 = all)",
+  "backup.last": "Last backup",
+  "backup.s3Ok": "uploaded",
+  "jobs.fromTemplate": "New automation from a template",
+  "jobs.tplName": "Name",
+  "jobs.tplProject": "Project folder",
+  "jobs.tplSchedule": "When",
+  "jobs.tplCronHint": "Cron: minute hour day month weekday (server time zone).",
+  "jobs.tplMode": "Mode",
+  "jobs.tplPrompt": "Task for the agent",
+  "jobs.tplCreate": "Create automation",
   "new.title": "New session",
   "new.directory": "Project directory",
   "new.up": "Up",
@@ -569,6 +597,8 @@ export const en = {
   "settings.notifications": "Notifications",
   "settings.notificationsEnable": "Enable",
   "settings.notificationsOn": "Enabled",
+  "settings.digest": "Daily cost summary at 20:00",
+  "settings.digestNow": "Send today's summary now",
   "settings.pushTest": "Send test",
   "settings.pushTestSent": "Test notification sent",
   "settings.pushTestNone": "No device subscribed",
@@ -701,6 +731,7 @@ export const en = {
 
   "common.ok": "OK",
   "common.cancel": "Cancel",
+  "common.refresh": "Refresh",
   "nav.logout": "Sign out",
   "login.username": "Username",
   "login.password": "Password",