Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/main.rs

@@ -5,6 +5,7 @@ mod app;
 mod auth;
 mod budget;
 mod config;
+mod docs;
 mod files;
 mod git;
 mod images;
@@ -12,7 +13,10 @@ mod mcp;
 mod permission;
 mod prompts;
 mod provider;
+mod reverse;
 mod runner;
+mod sandbox;
+mod shells;
 mod store;
 mod tools;
 mod types;
@@ -35,6 +39,7 @@ async fn main() -> Result<()> {
     let (cfg, _) = config::load_or_init(&path)?;
     tracing::info!("config: {}", path.display());
     tracing::info!("workspace: {}", cfg.workspace().display());
+    let _ = sandbox::probe().await;
     let bind = cfg.server.bind.clone();
     let app = app::App::new(path, cfg).await?;
     let router = api::router(app);