Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/themes/catppuccin-dark.css

@@ -0,0 +1,40 @@
+/*
+ * Catppuccin Mocha
+ * Palette: Catppuccin Mocha (catppuccin/catppuccin, MIT).
+ */
+:root[data-theme="catppuccin-dark"] {
+  color-scheme: dark;
+  --theme-color: #1e1e2e;
+
+  --bg0: #1e1e2e;
+  --bg1: #181825;
+  --bg2: #313244;
+  --bg3: #45475a;
+  --fg0: #cdd6f4;
+  --fg1: #cdd6f4;
+  --fg2: #bac2de;
+  --fg3: #a6adc8;
+  --muted: #9399b2;
+
+  --accent: #cba6f7;
+  --accent2: #fab387;
+  --on-accent: #1e1e2e;
+  --red: #f38ba8;
+  --green: #a6e3a1;
+  --aqua: #94e2d5;
+  --blue: #89b4fa;
+  --purple: #f5c2e7;
+
+  --diff-add: rgba(166, 227, 161, 0.16);
+  --diff-del: rgba(243, 139, 168, 0.16);
+  --shadow: 0 6px 24px rgba(0, 0, 0, 0.35);
+
+  --syntax-keyword: #cba6f7;
+  --syntax-string: #a6e3a1;
+  --syntax-number: #fab387;
+  --syntax-comment: #7f849c;
+  --syntax-function: #89b4fa;
+  --syntax-type: #f9e2af;
+  --syntax-variable: #cdd6f4;
+  --syntax-meta: #f5c2e7;
+}