initial: Steam-Cloud-style per-user state sync skeleton

HTTP API + on-disk storage + auth-service token verification + dev mode.
31 tests pass, vet clean. See DESIGN.md for the architecture and
README.md for the operator surface.

Pending: pg-backed per-user quota override, snapshot retention / blob GC,
tarball-vs-manifest content cross-check, end-to-end deploy on john.

Makefile

@@ -0,0 +1,18 @@
+.PHONY: build test vet run dev clean
+
+build:
+	go build -o cloud-svc .
+
+test:
+	go test ./...
+
+vet:
+	go vet ./...
+
+# Run in dev mode (accepts any bearer token) against ./data
+dev: build
+	CLOUD_DEV_MODE=1 CLOUD_STORAGE_ROOT=./data CLOUD_LISTEN=127.0.0.1:9091 ./cloud-svc
+
+clean:
+	rm -f cloud-svc
+	rm -rf ./data