initial: Steam-Cloud-style per-user state sync skeleton

HTTP API + on-disk storage + auth-service token verification + dev mode.
31 tests pass, vet clean. See DESIGN.md for the architecture and
README.md for the operator surface.

Pending: pg-backed per-user quota override, snapshot retention / blob GC,
tarball-vs-manifest content cross-check, end-to-end deploy on john.

config.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+)
+
+// Config wires env-driven settings. Mirrors other automc services' pattern:
+// env vars all-caps with CLOUD_ prefix. No YAML/JSON config file — env only.
+type Config struct {
+	Listen          string        // e.g. "127.0.0.1:9091"
+	StorageRoot     string        // e.g. "/data" inside container, mapped to ~/automc/cloud-data
+	AuthServiceURL  string        // e.g. "http://auth-service:9090"
+	ServiceKey      string        // cloud-svc's own X-API-Key when calling auth-service
+	AuthCacheTTL    time.Duration // verified-token cache TTL
+	DefaultQuotaMB  int64         // per-user default quota
+	DevMode         bool          // accept-any-bearer + skip auth-service
+}
+
+func LoadConfig() (*Config, error) {
+	c := &Config{
+		Listen:         envOr("CLOUD_LISTEN", "127.0.0.1:9091"),
+		StorageRoot:    envOr("CLOUD_STORAGE_ROOT", "/data"),
+		AuthServiceURL: envOr("CLOUD_AUTH_SERVICE_URL", "http://auth-service:9090"),
+		ServiceKey:     os.Getenv("CLOUD_SERVICE_KEY"),
+		DevMode:        os.Getenv("CLOUD_DEV_MODE") == "1",
+	}
+
+	ttl, err := time.ParseDuration(envOr("CLOUD_AUTH_CACHE_TTL", "60s"))
+	if err != nil {
+		return nil, fmt.Errorf("CLOUD_AUTH_CACHE_TTL: %w", err)
+	}
+	c.AuthCacheTTL = ttl
+
+	quotaStr := envOr("CLOUD_DEFAULT_QUOTA_MB", "200")
+	q, err := strconv.ParseInt(quotaStr, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("CLOUD_DEFAULT_QUOTA_MB: %w", err)
+	}
+	if q <= 0 {
+		return nil, fmt.Errorf("CLOUD_DEFAULT_QUOTA_MB must be > 0, got %d", q)
+	}
+	c.DefaultQuotaMB = q
+
+	if !c.DevMode && c.ServiceKey == "" {
+		return nil, fmt.Errorf("CLOUD_SERVICE_KEY required when CLOUD_DEV_MODE != 1")
+	}
+	return c, nil
+}
+
+func envOr(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}