Backups to master, replacement-VPS restore, broker proxy, multi-instance

Four features:

- Backup: lib/backup-sync.ts pushes the full settings table and firm
  credentials (the deliberate exception to "credentials never leave the
  machine") to the master's bearer-gated /api/instances/backup — every
  5 minutes when the content hash changed, within seconds of a settings
  or credential edit, and on the new backup-now command. Enabled by the
  master_backup_token setting.

- Restore: a dead VPS's replacement pulls the backup and adopts its
  uuid/name, so roster, payouts and card links carry on. Pre-boot via
  seed-settings.js --restore-from (setup-linux.sh prompts for it) or
  the Settings page's restore picker (lib/backup-restore.ts). Stop the
  old machine first; the master 409s a live-name rename.

- Proxy: the proxy_url setting routes BROKER traffic only — TopstepX
  REST + SignalR hub, Tradovate REST + websocket, Yahoo quotes — via
  lib/outbound-proxy.ts (axios agents, undici dispatcher, ws agent).
  The master link, reporter, catalog and backup push stay direct, so a
  dead proxy cannot take down the control channel. Restart to apply.

- Multi-instance: AUTOFIRMER_DB moves the SQLite file so one checkout
  runs N instances; scripts/instances.json (per-device, gitignored)
  drives start-all/update-check, and add-instance.sh / remove-instance.sh
  manage the extra PM2 processes. Absent registry = single-instance
  behavior, unchanged. Instance 1 keeps port 3000 for the clicker and
  extension.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/topstepx-class.ts

@@ -24,6 +24,7 @@ import axios from 'axios';
 import * as signalR from '@microsoft/signalr';
 import { currentTradeDateCT } from './trading-logic';
 import { getCachedContract } from './contract-resolver';
+import { signalrWebSocket } from './outbound-proxy';
 import { saveDailyPnL, loadDailyPnL, loadAccountMeta, saveAccountMeta, loadFundTransactions, saveFundTransactions } from './db';
 import { getAccountConfig } from './account-type-resolver';
 import type { PlatformClient, PlatformAccount, PlatformContract } from './platform-client';
@@ -258,11 +259,16 @@ export class TopstepXClient implements PlatformClient {
         // the package is listed in next.config serverExternalPackages and any
         // residual failure here is caught by the caller (REST polling covers
         // everything the hub does, just slower).
+        // With skipNegotiation the hub is a single websocket to a broker
+        // endpoint, so it follows the operator's proxy like the REST calls do.
+        const proxiedWs = signalrWebSocket();
         const hub = new signalR.HubConnectionBuilder()
             .withUrl(USER_HUB, {
                 skipNegotiation: true,
                 transport: signalR.HttpTransportType.WebSockets,
                 accessTokenFactory: () => this.token ?? '',
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                ...(proxiedWs ? { WebSocket: proxiedWs as any } : {}),
             })
             .withAutomaticReconnect()
             .configureLogging(signalR.LogLevel.Warning)