initial: Steam-Cloud-style per-user state sync skeleton

HTTP API + on-disk storage + auth-service token verification + dev mode.
31 tests pass, vet clean. See DESIGN.md for the architecture and
README.md for the operator surface.

Pending: pg-backed per-user quota override, snapshot retention / blob GC,
tarball-vs-manifest content cross-check, end-to-end deploy on john.

Dockerfile

@@ -0,0 +1,14 @@
+FROM golang:1.25-alpine AS builder
+WORKDIR /build
+COPY go.mod go.sum* ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloud-svc .
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata && adduser -D -u 1000 cloud
+WORKDIR /app
+COPY --from=builder /out/cloud-svc /app/cloud-svc
+USER cloud
+EXPOSE 9091
+ENTRYPOINT ["/app/cloud-svc"]