Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/components/GitPanel.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { post } from "../api";
 import { fmtRelative, useT } from "../i18n";
 import { Spinner } from "./Activity";
+import { confirmDialog, promptDialog, toast } from "../dialogs";
 
 export interface GitFile {
   path: string;
@@ -90,7 +91,7 @@ export function GitPanel({
       const r = await call<{ diff: string }>("diff", { files: [abs(f)], staged: isStaged });
       showDiff(`${f.path}${isStaged ? ` (${t("git.staged")})` : ""}`, r.diff);
     } catch (e: any) {
-      alert(e.message);
+      toast(e.message);
     }
   };
 
@@ -112,7 +113,7 @@ export function GitPanel({
         ) : (
           <>
             {f.index !== "?" && (
-              <button className="small ghost danger" title={t("git.discard")} onClick={() => confirm(t("git.discardConfirm", { file: f.path })) && run("discard", () => call("discard", { files: [abs(f)] }))}>
+              <button className="small ghost danger" title={t("git.discard")} onClick={() => void confirmDialog({ message: t("git.discardConfirm", { file: f.path }), danger: true, confirmLabel: t("git.discard") }).then((ok): unknown => ok && run("discard", () => call("discard", { files: [abs(f)] })))}>
                 ↺
               </button>
             )}
@@ -143,8 +144,8 @@ export function GitPanel({
         <button
           className="small"
           title={t("git.newBranch")}
-          onClick={() => {
-            const name = prompt(t("git.newBranchName"));
+          onClick={async () => {
+            const name = await promptDialog({ message: t("git.newBranchName"), placeholder: "feature/…" });
             if (name) void run("checkout", () => call("checkout", { branch: name, create: true }), true);
           }}
         >