Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/types.ts

@@ -56,6 +56,8 @@ export interface Session {
   last_usage?: Usage | null;
   busy?: boolean;
   owner_id?: string | null;
+  /** Craft: clean room (true) or deep (false); undefined = server default. */
+  clean_room?: boolean | null;
   /** Listed because it was shared with the current user. */
   shared?: boolean;
 }
@@ -108,6 +110,7 @@ export type ServerEvent =
   | { type: "error"; session_id: string; message: string }
   | { type: "waiting"; session_id: string; reason: string | null }
   | { type: "queue_updated"; session_id: string; items: QueueItem[] }
+  | { type: "step_started"; session_id: string; message_id: string; started_at: number; prompt_tokens: number; estimated: boolean }
   | { type: "mcp_status"; servers: Record<string, McpServerStatus> }
   | { type: "resync" };
 
@@ -120,8 +123,14 @@ export interface ModelInfo {
   id: string;
   name: string;
   context?: number;
+  max_output?: number | null;
   reasoning: boolean;
   vision: boolean;
+  effort?: string | null;
+  input_price?: number | null;
+  output_price?: number | null;
+  cache_read_price?: number | null;
+  cache_write_price?: number | null;
 }
 
 export interface ProviderModels {
@@ -164,6 +173,7 @@ export interface User {
   oidc: boolean;
   disabled: boolean;
   created_at: number;
+  monthly_quota?: number | null;
 }
 
 export interface Info {