Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/components/Sidebar.tsx

@@ -1,4 +1,5 @@
-import { useMemo } from "react";
+import { cycleThemeMode, getThemeMode, onThemeChange } from "../theme";
+import { useMemo, useSyncExternalStore } from "react";
 import { post } from "../api";
 import { fmtRelative, useT, type Key } from "../i18n";
 import { navigate } from "../router";
@@ -88,6 +89,7 @@ export function Sidebar({ open, activeId, section }: { open: boolean; activeId?:
           {me?.display_name || me?.username}
           {me?.role === "admin" && <span className="chip" style={{ marginLeft: 6 }}>admin</span>}
         </span>
+        <ThemeModeButton />
         <button className="small ghost" onClick={() => post("/auth/logout").then(() => location.reload())}>
           {t("nav.logout")}
         </button>
@@ -109,3 +111,16 @@ export function Sidebar({ open, activeId, section }: { open: boolean; activeId?:
     </aside>
   );
 }
+
+/** Quick light/dark/auto switcher. */
+function ThemeModeButton() {
+  const t = useT();
+  const mode = useSyncExternalStore(onThemeChange, getThemeMode);
+  const icon = mode === "auto" ? "◐" : mode === "light" ? "☀" : "☾";
+  const label = t(mode === "auto" ? "settings.themeAuto" : mode === "light" ? "settings.themeLight" : "settings.themeDark");
+  return (
+    <button className="small ghost theme-toggle" onClick={cycleThemeMode} title={`${t("settings.themeToggle")} – ${label}`} aria-label={t("settings.themeToggle")}>
+      {icon}
+    </button>
+  );
+}