Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -173,16 +173,46 @@ Compound shell commands (`&&`, `;`, `|`) are only auto-allowed when every part i
 
 ## Themes
 
-Colours, syntax highlighting and chart palettes come from CSS variables. Each theme is one
-file in [`web/src/themes`](web/src/themes) (Gruvbox Dark and Light ship by default):
+Pick a **base theme** in *Settings → Interface* and switch **light / dark / auto** there or with
+the ◐ button in the sidebar (auto follows the system preference). Every base theme has a dark and
+a light variant. The palettes come from [zink/trilium-themes](https://git.familie-zink.org/zink/trilium-themes)
+(MIT, see [`web/src/themes/LICENSE-trilium-themes`](web/src/themes/LICENSE-trilium-themes)), which
+in turn are based on:
 
-1. Copy `gruvbox-dark.css` to `<id>.css`, change the values on `:root[data-theme="<id>"]`.
-2. Import it in `themes/index.ts` and add it to `THEMES` in `web/src/theme.ts`.
+| Theme | Variants | Palette source | License |
+|---|---|---|---|
+| Gruvbox | Dark, Light | [morhetz/gruvbox](https://github.com/morhetz/gruvbox) | MIT |
+| Ash | Dark, Light | original, Gruvbox-derived ([zink/trilium-themes](https://git.familie-zink.org/zink/trilium-themes)) | MIT |
+| Harbor | Dark, Light | [HANCORE-linux/omarchy-harbordark-theme](https://github.com/HANCORE-linux/omarchy-harbordark-theme) | MIT |
+| Coffee | Dark, Latte | [megabyte0x/omarchy-coffee-theme](https://github.com/megabyte0x/omarchy-coffee-theme) | MIT |
+| Solarized | Dark, Light | [Solarized by Ethan Schoonover](https://ethanschoonover.com/solarized/) | MIT |
+| Tokyo Night | Night, Day | [folke/tokyonight.nvim](https://github.com/folke/tokyonight.nvim) | Apache-2.0 |
+
+Further standard themes (palettes re-created from the published colour specifications):
+
+| Theme | Variants | Palette source | License |
+|---|---|---|---|
+| Nord | Dark, Light (Snow Storm background) | [nordtheme/nord](https://github.com/nordtheme/nord) | MIT |
+| VS Code | Dark Modern, Light Modern | [microsoft/vscode](https://github.com/microsoft/vscode) | MIT |
+| GitHub | Dark, Light | [primer/github-vscode-theme](https://github.com/primer/github-vscode-theme) | MIT |
+| Catppuccin | Mocha, Latte | [catppuccin/catppuccin](https://github.com/catppuccin/catppuccin) | MIT |
+| One | One Dark, One Light | [atom/atom](https://github.com/atom/atom) | MIT |
+| Dracula | Dracula, Alucard | [dracula/dracula-theme](https://github.com/dracula/dracula-theme) | MIT |
+| Rosé Pine | Main, Dawn | [rose-pine/rose-pine-theme](https://github.com/rose-pine/rose-pine-theme) | MIT |
+| Everforest | Dark, Light | [sainnhe/everforest](https://github.com/sainnhe/everforest) | MIT |
+| Kanagawa | Wave, Lotus | [rebelot/kanagawa.nvim](https://github.com/rebelot/kanagawa.nvim) | MIT |
+
+Colours, syntax highlighting and chart palettes come from CSS variables, one file per variant in
+[`web/src/themes`](web/src/themes). To add a base theme `<id>`:
+
+1. Copy `gruvbox-dark.css` / `gruvbox-light.css` to `<id>-dark.css` / `<id>-light.css` and change
+   the values on `:root[data-theme="<id>-dark"]` / `"<id>-light"`; note source and license in the header.
+2. Import both in `themes/index.ts` and add the base theme to `THEMES` in `web/src/theme.ts`.
 
 The variables cover surfaces (`--bg0`–`--bg3`), text (`--fg0`–`--fg3`, `--muted`), accents,
-diffs, syntax (`--syntax-*`), charts (`--series-1`–`8` categorical, `--seq-0`–`6` sequential)
-and the browser bar colour (`--theme-color`). The chart colours are validated for colour-vision
-deficiencies against the background – re-check them when the background changes a lot.
+diffs, syntax (`--syntax-*`) and the browser bar colour (`--theme-color`). The chart palettes
+(`--series-1`–`8` categorical, `--seq-1`–`6` sequential) live in `themes/base.css` per light/dark
+mode and are validated for colour-vision deficiencies.
 
 ## Development