Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/components/settings/Users.tsx

@@ -4,6 +4,7 @@ import { useFetch } from "../../hooks";
 import { fmtDate, useT } from "../../i18n";
 import { useStore } from "../../store";
 import type { User } from "../../types";
+import { confirmDialog, promptDialog, toast } from "../../dialogs";
 
 export function Users() {
   const t = useT();
@@ -22,8 +23,8 @@ export function Users() {
     }
   };
 
-  const resetPassword = (u: User) => {
-    const pw = prompt(t("users.newPasswordFor", { name: u.username }));
+  const resetPassword = async (u: User) => {
+    const pw = await promptDialog({ message: t("users.newPasswordFor", { name: u.username }), password: true });
     if (pw) void run(() => patch(`/users/${u.id}`, { password: pw }));
   };
 
@@ -39,6 +40,7 @@ export function Users() {
               <th>{t("users.displayName")}</th>
               <th>{t("users.role")}</th>
               <th>{t("users.login")}</th>
+              <th>{t("users.quota")}</th>
               <th>{t("users.created")}</th>
               <th />
             </tr>
@@ -60,6 +62,19 @@ export function Users() {
                 <td>
                   {u.has_password && <span className="chip">{t("users.password")}</span>} {u.oidc && <span className="chip">SSO</span>}
                 </td>
+                <td>
+                  <button
+                    className="small ghost"
+                    title={t("users.quotaHint")}
+                    onClick={async () => {
+                      const v = await promptDialog({ message: t("users.quotaPrompt", { name: u.username }), defaultValue: u.monthly_quota != null ? String(u.monthly_quota) : "" });
+                      if (v === null) return;
+                      void run(() => patch(`/users/${u.id}`, { monthly_quota: v.trim() === "" ? -1 : Number(v.replace(",", ".")) }));
+                    }}
+                  >
+                    {u.monthly_quota != null ? u.monthly_quota : "∞"}
+                  </button>
+                </td>
                 <td>{fmtDate(u.created_at, false)}</td>
                 <td>
                   <div className="row" style={{ flexWrap: "nowrap" }}>
@@ -70,7 +85,7 @@ export function Users() {
                       {u.disabled ? t("users.enable") : t("users.disable")}
                     </button>
                     {u.id !== me?.id && (
-                      <button className="small danger" onClick={() => confirm(t("users.deleteConfirm", { name: u.username })) && run(() => del(`/users/${u.id}`))}>
+                      <button className="small danger" onClick={() => void confirmDialog({ message: t("users.deleteConfirm", { name: u.username }), danger: true, confirmLabel: t("common.delete") }).then((ok): unknown => ok && run(() => del(`/users/${u.id}`)))}>
                         {t("common.delete")}
                       </button>
                     )}