Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config.example.toml

@@ -134,6 +134,8 @@ enabled = false
 #  type = "stdio" → command + args (+ env), started as a child process
 #  type = "http"  → Streamable HTTP endpoint (url + optional headers)
 #  Tools appear to the model as  mcp__<server>__<tool>.
+#  users = [...]: who may use the server. Default: admins only.
+#  Use ["*"] for all users or list usernames, e.g. ["anna", "ben"].
 #  load = "auto" (default) | "always" | "on_demand": servers with many tools
 #  (more than server.mcp_direct_limit) are not sent with every request; the
 #  model finds them with mcp_search and calls them with mcp_call. This keeps
@@ -176,7 +178,10 @@ task = "allow"
 write = "ask"
 edit = "ask"
 bash = "ask"
+bash_output = "allow"
+kill_shell = "allow"
 web_fetch = "ask"
+web_search = "allow"
 browser_snapshot = "allow"
 image_compare = "allow"
 generate_image = "ask"   # costs money per image
@@ -283,6 +288,30 @@ link_by_username = false
 button_label = "Single sign-on"
 
 
+# -----------------------------------------------------------------------------
+#  Web search (web_search tool)
+# -----------------------------------------------------------------------------
+[search]
+# "duckduckgo" (no key, may be rate-limited), "searxng" (self-hosted, set url),
+# "brave" or "tavily" (api_key, e.g. "${BRAVE_API_KEY}")
+provider = "duckduckgo"
+url = ""
+api_key = ""
+
+
+# -----------------------------------------------------------------------------
+#  Sandbox
+# -----------------------------------------------------------------------------
+#  Shell commands and git of a user run in a bubblewrap sandbox: system
+#  read-only, only the user's folders writable, own home, own processes, no
+#  server environment. The network is shared (package managers keep working).
+#  Needs the security options in docker-compose.yml. Without a working
+#  sandbox, non-admin users cannot run shell commands.
+[sandbox]
+# "auto" = non-admin users, "always" = everybody (admins too), "off" = nobody
+mode = "auto"
+
+
 # -----------------------------------------------------------------------------
 #  Craft mode
 # -----------------------------------------------------------------------------