Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/components/Composer.tsx

@@ -3,6 +3,7 @@ import { useAgents, useFetch } from "../hooks";
 import { useT, type Key } from "../i18n";
 import type { ImageData, Session } from "../types";
 import { ModelSelect } from "./ModelSelect";
+import { confirmDialog, promptDialog, toast } from "../dialogs";
 
 interface Suggestion {
   name: string;
@@ -119,7 +120,7 @@ export function Composer({
       const imgs = await Promise.all(all.filter((f) => f.type.startsWith("image/")).map(readImage));
       setImages((cur) => [...cur, ...imgs]);
     } catch (e: any) {
-      alert(e.message ?? String(e));
+      toast(e.message ?? String(e));
     }
     // Everything else is uploaded into the project folder.
     for (const f of all.filter((f) => !f.type.startsWith("image/"))) {
@@ -135,7 +136,7 @@ export function Composer({
         if (!res.ok) throw new Error(`${f.name}: HTTP ${res.status}${res.status === 413 ? " – too large for the reverse proxy" : ""}`);
         setFiles((cur) => [...cur, { name: f.name, path, size: f.size }]);
       } catch (e: any) {
-        alert(e.message ?? String(e));
+        toast(e.message ?? String(e));
       } finally {
         setUploading((n) => n - 1);
       }
@@ -238,6 +239,16 @@ export function Composer({
               </button>
             ))}
           </div>
+          {session.agent === "craft" && (
+            <div className="mode-tabs" role="tablist" aria-label={t("craft.mode")} title={t("craft.modeHint")}>
+              <button className={session.clean_room !== false ? "active" : ""} onClick={() => onUpdate({ clean_room: true })}>
+                {t("craft.cleanRoom")}
+              </button>
+              <button className={session.clean_room === false ? "active deep" : ""} onClick={() => onUpdate({ clean_room: false })}>
+                {t("craft.deep")}
+              </button>
+            </div>
+          )}
           <select
             value={session.permission_mode}
             onChange={(e) => onUpdate({ permission_mode: e.target.value as Session["permission_mode"] })}