Backups to master, replacement-VPS restore, broker proxy, multi-instance

Four features:

- Backup: lib/backup-sync.ts pushes the full settings table and firm
  credentials (the deliberate exception to "credentials never leave the
  machine") to the master's bearer-gated /api/instances/backup — every
  5 minutes when the content hash changed, within seconds of a settings
  or credential edit, and on the new backup-now command. Enabled by the
  master_backup_token setting.

- Restore: a dead VPS's replacement pulls the backup and adopts its
  uuid/name, so roster, payouts and card links carry on. Pre-boot via
  seed-settings.js --restore-from (setup-linux.sh prompts for it) or
  the Settings page's restore picker (lib/backup-restore.ts). Stop the
  old machine first; the master 409s a live-name rename.

- Proxy: the proxy_url setting routes BROKER traffic only — TopstepX
  REST + SignalR hub, Tradovate REST + websocket, Yahoo quotes — via
  lib/outbound-proxy.ts (axios agents, undici dispatcher, ws agent).
  The master link, reporter, catalog and backup push stay direct, so a
  dead proxy cannot take down the control channel. Restart to apply.

- Multi-instance: AUTOFIRMER_DB moves the SQLite file so one checkout
  runs N instances; scripts/instances.json (per-device, gitignored)
  drives start-all/update-check, and add-instance.sh / remove-instance.sh
  manage the extra PM2 processes. Absent registry = single-instance
  behavior, unchanged. Instance 1 keeps port 3000 for the clicker and
  extension.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/instances.mjs

@@ -0,0 +1,44 @@
+/**
+ * The per-device instance registry: which autofirmer processes run on this
+ * machine, on which ports, against which databases.
+ *
+ * scripts/instances.json is created and edited by add-instance.sh /
+ * remove-instance.sh. When the file is absent the device is a legacy
+ * single-instance install and everything behaves exactly as it always has:
+ * one PM2 process named `autofirmer` on port 3000 using ./autotrader.sqlite.
+ *
+ * Entry shape: { "name": "autofirmer-2", "port": 3100, "db": ".data/instance-2/autotrader.sqlite" }
+ * `db` is relative to the project root. Instance 1 keeps the legacy
+ * name/port/db so the clicker and extension (hardwired to :3000) still work.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const REGISTRY_FILE = path.join(ROOT, 'scripts', 'instances.json');
+
+const LEGACY = [{
+    name: 'autofirmer',
+    port: Number(process.env.AUTOFIRMER_PORT ?? '3000'),
+    db: 'autotrader.sqlite',
+}];
+
+export function loadInstances() {
+    if (!existsSync(REGISTRY_FILE)) return LEGACY;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(REGISTRY_FILE, 'utf8'));
+    } catch (err) {
+        throw new Error(`scripts/instances.json is not valid JSON: ${err.message}`);
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0) return LEGACY;
+    for (const e of parsed) {
+        if (typeof e?.name !== 'string' || !e.name
+            || !Number.isInteger(e?.port)
+            || typeof e?.db !== 'string' || !e.db) {
+            throw new Error(`scripts/instances.json entry is malformed: ${JSON.stringify(e)}`);
+        }
+    }
+    return parsed;
+}