Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/ghidra/install-ghidra.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Installs Temurin JDK 25 and Ghidra into $1 (default /data/tools). Idempotent.
+# On architectures without prebuilt decompiler binaries (e.g. ARM64) the
+# native decompiler is built from the sources shipped with Ghidra.
+set -eu
+DEST="${1:-/data/tools}"
+GHIDRA_URL="${GHIDRA_URL:-https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_12.2_build/ghidra_12.2_PUBLIC_20261016.zip}"
+case "$(uname -m)" in
+  x86_64) ARCH=x64 ;;
+  aarch64|arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $(uname -m)"; exit 1 ;;
+esac
+mkdir -p "$DEST"
+cd "$DEST"
+if ! jdk/bin/java -version 2>&1 | grep -q '"25'; then
+  echo "Downloading JDK 25 ($ARCH)..."
+  curl -fsSL "https://api.adoptium.net/v3/binary/latest/25/ga/linux/$ARCH/jdk/hotspot/normal/eclipse" -o jdk.tar.gz
+  rm -rf jdk jdk.tmp && mkdir jdk.tmp && tar -xzf jdk.tar.gz -C jdk.tmp --strip-components=1 && mv jdk.tmp jdk && rm jdk.tar.gz
+fi
+if [ ! -x ghidra/support/analyzeHeadless ]; then
+  echo "Downloading Ghidra..."
+  curl -fsSL "$GHIDRA_URL" -o ghidra.zip
+  rm -rf ghidra ghidra.tmp && mkdir ghidra.tmp && unzip -q ghidra.zip -d ghidra.tmp && mv ghidra.tmp/ghidra_* ghidra && rmdir ghidra.tmp && rm ghidra.zip
+fi
+# Use our JDK without asking.
+sed -i "s#^JAVA_HOME_OVERRIDE=.*#JAVA_HOME_OVERRIDE=$DEST/jdk#" ghidra/support/launch.properties
+
+# Native decompiler for this platform.
+OSDIR=linux_x86_64
+[ "$ARCH" = aarch64 ] && OSDIR=linux_arm_64
+NATIVE="ghidra/Ghidra/Features/Decompiler/os/$OSDIR"
+if [ ! -x "$NATIVE/decompile" ]; then
+  echo "Building the native decompiler for $OSDIR (a few minutes)..."
+  SRC="ghidra/Ghidra/Features/Decompiler/src/decompile/cpp"
+  ( cd "$SRC" && mkdir -p ghi_opt sla_opt com_opt && make -j"$(nproc)" ARCH_TYPE= ghidra_opt sleigh_opt >/tmp/ghidra-native.log 2>&1 ) || { tail -20 /tmp/ghidra-native.log; exit 1; }
+  mkdir -p "$NATIVE"
+  cp "$SRC/ghidra_opt" "$NATIVE/decompile"
+  cp "$SRC/sleigh_opt" "$NATIVE/sleigh"
+  ( cd "$SRC" && make clean >/dev/null 2>&1 || true )
+fi
+"$DEST/jdk/bin/java" -version 2>&1 | head -1
+echo "Ghidra installed in $DEST/ghidra ($OSDIR)"