Backups to master, replacement-VPS restore, broker proxy, multi-instance

Four features:

- Backup: lib/backup-sync.ts pushes the full settings table and firm
  credentials (the deliberate exception to "credentials never leave the
  machine") to the master's bearer-gated /api/instances/backup — every
  5 minutes when the content hash changed, within seconds of a settings
  or credential edit, and on the new backup-now command. Enabled by the
  master_backup_token setting.

- Restore: a dead VPS's replacement pulls the backup and adopts its
  uuid/name, so roster, payouts and card links carry on. Pre-boot via
  seed-settings.js --restore-from (setup-linux.sh prompts for it) or
  the Settings page's restore picker (lib/backup-restore.ts). Stop the
  old machine first; the master 409s a live-name rename.

- Proxy: the proxy_url setting routes BROKER traffic only — TopstepX
  REST + SignalR hub, Tradovate REST + websocket, Yahoo quotes — via
  lib/outbound-proxy.ts (axios agents, undici dispatcher, ws agent).
  The master link, reporter, catalog and backup push stay direct, so a
  dead proxy cannot take down the control channel. Restart to apply.

- Multi-instance: AUTOFIRMER_DB moves the SQLite file so one checkout
  runs N instances; scripts/instances.json (per-device, gitignored)
  drives start-all/update-check, and add-instance.sh / remove-instance.sh
  manage the extra PM2 processes. Absent registry = single-instance
  behavior, unchanged. Instance 1 keeps port 3000 for the clicker and
  extension.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

setup-linux.sh

@@ -86,6 +86,11 @@ read -r -p "  Master dashboard URL [$DEFAULT_MASTER]: " MASTER_URL
 MASTER_URL="${MASTER_URL:-$DEFAULT_MASTER}"
 read -r -p "  Instance name [$(hostname)]: " INSTANCE
 INSTANCE="${INSTANCE:-$(hostname)}"
+read -r -p "  Backup token (blank = no master backups): " BACKUP_TOKEN
+RESTORE_FROM=""
+if [ -n "$BACKUP_TOKEN" ]; then
+    read -r -p "  Restore a dead instance? Its uuid (blank = fresh install): " RESTORE_FROM
+fi
 echo
 info "installing to: $TARGET"
 echo
@@ -115,7 +120,13 @@ npm run build
 
 # ── 4. settings ─────────────────────────────────────────────────────────────
 info "[4/7] writing instance settings..."
-node scripts/seed-settings.js "$MASTER_URL" "$INSTANCE"
+SEED_ARGS=()
+[ -n "$BACKUP_TOKEN" ] && SEED_ARGS+=(--token "$BACKUP_TOKEN")
+# --restore-from pulls the dead instance's backup (settings, credentials,
+# identity) before the app ever boots, so its very first hello to the master
+# presents the adopted uuid. Stop the old machine first if it still runs.
+[ -n "$RESTORE_FROM" ] && SEED_ARGS+=(--restore-from "$RESTORE_FROM")
+node scripts/seed-settings.js "$MASTER_URL" "$INSTANCE" ${SEED_ARGS[@]+"${SEED_ARGS[@]}"}
 
 # ── 5. python ───────────────────────────────────────────────────────────────
 # A virtualenv rather than a system pip install: Raspberry Pi OS Bookworm