Backups to master, replacement-VPS restore, broker proxy, multi-instance

Four features:

- Backup: lib/backup-sync.ts pushes the full settings table and firm
  credentials (the deliberate exception to "credentials never leave the
  machine") to the master's bearer-gated /api/instances/backup — every
  5 minutes when the content hash changed, within seconds of a settings
  or credential edit, and on the new backup-now command. Enabled by the
  master_backup_token setting.

- Restore: a dead VPS's replacement pulls the backup and adopts its
  uuid/name, so roster, payouts and card links carry on. Pre-boot via
  seed-settings.js --restore-from (setup-linux.sh prompts for it) or
  the Settings page's restore picker (lib/backup-restore.ts). Stop the
  old machine first; the master 409s a live-name rename.

- Proxy: the proxy_url setting routes BROKER traffic only — TopstepX
  REST + SignalR hub, Tradovate REST + websocket, Yahoo quotes — via
  lib/outbound-proxy.ts (axios agents, undici dispatcher, ws agent).
  The master link, reporter, catalog and backup push stay direct, so a
  dead proxy cannot take down the control channel. Restart to apply.

- Multi-instance: AUTOFIRMER_DB moves the SQLite file so one checkout
  runs N instances; scripts/instances.json (per-device, gitignored)
  drives start-all/update-check, and add-instance.sh / remove-instance.sh
  manage the extra PM2 processes. Absent registry = single-instance
  behavior, unchanged. Instance 1 keeps port 3000 for the clicker and
  extension.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/remove-instance.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#
+# Unregister an instance added by add-instance.sh: stops its PM2 process and
+# drops it from scripts/instances.json. The database directory is left on
+# disk — deleting credentials is a decision for a human with rm.
+#
+#   ./scripts/remove-instance.sh <N>
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+REGISTRY="$ROOT/scripts/instances.json"
+
+info() { printf '  %s\n' "$1"; }
+die()  { printf '  [X] %s\n' "$1" >&2; exit 1; }
+
+[ $# -eq 1 ] || die "usage: $0 <N>"
+N="$1"
+case "$N" in (*[!0-9]*|'') die "N must be a number, got: $N" ;; esac
+[ "$N" -ge 2 ] || die "instance 1 is the legacy install - remove it with pm2 delete autofirmer"
+[ -f "$REGISTRY" ] || die "no scripts/instances.json - nothing to remove"
+
+PM2_NAME="autofirmer-$N"
+
+node - "$REGISTRY" "$PM2_NAME" <<'NODE'
+const { readFileSync, writeFileSync } = require('node:fs');
+const [, file, name] = process.argv;
+const entries = JSON.parse(readFileSync(file, 'utf8'));
+if (!entries.some((e) => e.name === name)) { console.error(`  [X] ${name} is not registered`); process.exit(1); }
+writeFileSync(file, JSON.stringify(entries.filter((e) => e.name !== name), null, 4) + '\n');
+console.log(`  registry: ${name} removed`);
+NODE
+
+pm2 delete "$PM2_NAME" >/dev/null 2>&1 || info "pm2: $PM2_NAME was not running"
+pm2 save >/dev/null
+info "pm2: $PM2_NAME deleted and process list saved"
+info "database left at .data/instance-$N/ - delete by hand if you mean it"