feat: opt-in by sync.json + per-instance ULID + restic subpath

Reshapes the launcher integration around two ideas:

  1. ONE global Prism PreLaunch/PostExit hook is enough for all
     instances. Wire it once at Settings > Default > Custom commands:

         python /opt/cloud-sync.pyz pull --pack-folder=$INST_MC_DIR
         python /opt/cloud-sync.pyz push --pack-folder=$INST_MC_DIR

     Instances WITHOUT .cloud-sync/sync.json are silent no-ops (rc=0,
     no UI, no banner). The opt-in probe runs BEFORE the UI factory
     so Prism's launch log stays clean for non-sync instances.

  2. Per-instance opt-in via 'setup' / 'init' subcommands that mint a
     fresh ULID-style instance_id + write sync.json (mode 644) and
     token (mode 600). 'disable' removes sync.json; cloud data
     untouched.

Restic URL gains an /<instance_id>/ subpath under the user's
namespace, so two Prism instances of the same Discord user no longer
share a snapshot timeline. --private-repos still gates on the first
path segment (the username); deeper segments are user-controlled,
so this works without server-side coordination. First-push-on-a-new-
instance probes via 'restic cat config' and 'init's the per-instance
repo if absent.

UI label resolution is runtime-only (NEVER stored in sync.json) so
the user renaming the Prism instance just propagates through on
next launch:

    --instance-label  >  $INST_NAME  >  $INST_ID  >  instance_id[:8]

Schema bumps:
  state.json schema: 1 -> 2, adds instance_id field. Schema-1 files
  are treated as missing (existing test1 user re-pulls fresh).
  sync.json schema: 1 (new file).

CLI rework:
  pull / push   no --url; load everything from sync.json
  setup         interactive: Qt login dialog for token; URL prompt
                if --url omitted; falls back to stdin when headless
  init          non-interactive setup; for scripted callers
  disable       rm sync.json

Args dataclass: drops 'url', adds 'instance_label'. cli.parse() now
returns (cmd, Namespace); a separate args_from(ns) builds the Args
so each subcommand can pluck the bits it needs from the Namespace
without forcing a 'one Args fits all subcommands' shape.

73 tests green; pyz 75 KB.

Smoke-verified locally:
  - pull/push on a folder without sync.json: silent rc=0, no banner
  - init writes sync.json (644) + token (600) with correct contents
  - disable removes sync.json, keeps token
  - mint produces unique 26-char base32 instance_ids
  - label resolution chain (flag > INST_NAME > INST_ID > prefix)

README.md

@@ -24,32 +24,57 @@ make install     # pip install -e .
 
 ## Usage in Prism (or MMC / ATLauncher)
 
-Instance Settings → Custom commands:
+**One-time global wiring.** Settings → Default → Custom commands (NOT per-instance):
 
 ```
-Pre-launch:
-  python /path/to/cloud-sync.pyz pull --url=https://cloud.tm.center --pack-folder=$INST_MC_DIR
-
-Post-exit:
-  python /path/to/cloud-sync.pyz push --url=https://cloud.tm.center --pack-folder=$INST_MC_DIR
+Pre-launch:  python /path/to/cloud-sync.pyz pull --pack-folder=$INST_MC_DIR
+Post-exit:   python /path/to/cloud-sync.pyz push --pack-folder=$INST_MC_DIR
 ```
 
-Player needs Python 3.10+ on PATH AND a Qt binding (`pip install PySide6`). The first pull on a fresh instance opens a "CONNECT TO THE NETWORK" dialog; the player pastes a token they got via `/cloud register` in Discord. The token lands at `<INST_MC_DIR>/.cloud-sync/token`.
+That single line works for every existing and future instance. Instances without a `.cloud-sync/sync.json` are no-ops (silent rc=0, MC launches normally) — sync only kicks in for instances you've explicitly opted in.
 
-If `PySide6` / `PyQt6` is missing the pyz falls back to headless mode (status to stdout). The conflict + login dialogs do not have a headless mode — without Qt the conflict path aborts the launch defensively, and the login path tells the user to paste the token manually.
+**Per-instance opt-in:**
+
+```
+# interactive — opens Qt login dialog for the token
+python /path/to/cloud-sync.pyz setup --pack-folder=/path/to/instance/minecraft
+
+# scripted equivalent
+python /path/to/cloud-sync.pyz init \
+    --pack-folder=/path/to/instance/minecraft \
+    --url=https://cloud.tm.center \
+    --token=DISCORD_ID:PASSWORD
+```
+
+That mints a fresh `instance_id` (ULID), writes `.cloud-sync/sync.json` (the opt-in marker) and `.cloud-sync/token` (mode 600). Subsequent launches sync automatically via the global hook.
+
+**Opting out:**
+
+```
+python /path/to/cloud-sync.pyz disable --pack-folder=/path/to/instance/minecraft
+```
+
+Removes `sync.json` (cloud data untouched). Instance returns to no-op behavior.
+
+Player needs Python 3.10+ AND a Qt binding (`pip install PySide6`). Without Qt the pyz falls back to headless mode for status; the conflict + login dialogs are Qt-only — without them, conflict aborts the launch defensively and `setup` prompts for the token via stdin.
 
 ## CLI
 
 ```
-python cloud-sync.pyz {pull,push} \
-    --url URL              Timemachine Network endpoint (required)
-    --pack-folder PATH     Minecraft instance directory (default: cwd)
-    --token-file PATH      override default <pack-folder>/.cloud-sync/token
-    --restic-binary PATH   skip auto-discovery
-    --no-download          fail if no usable restic; don't fetch from upstream
-    -g, --no-gui           headless mode (no Qt windows)
+instance-sync pull / push [--pack-folder=PATH]
+                          [--token-file=PATH]
+                          [--restic-binary=PATH]
+                          [--no-download]
+                          [-g | --no-gui]
+                          [--instance-label="Friendly Name"]
+
+instance-sync setup       [--url=URL] [--pack-folder=PATH]     # interactive
+instance-sync init        --url=URL [--token=ID:PASS] ...      # scripted
+instance-sync disable     [--pack-folder=PATH]
 ```
 
+`pull` and `push` don't take `--url` — it's loaded from `sync.json`. `--instance-label` overrides the UI display name (defaults to `$INST_NAME` from Prism, then `$INST_ID`, then the first 8 chars of `instance_id`).
+
 ## Programmatic API (for frazclient)
 
 ```python
@@ -57,15 +82,17 @@ from pathlib import Path
 import cloud_sync
 
 cloud_sync.pull(cloud_sync.Args(
-    url="https://cloud.tm.center",
     pack_folder=Path("/srv/mc/instance"),
     token_file=Path("/srv/mc/instance/.cloud-sync/token"),
     restic_binary=None,        # auto-discover
     allow_download=True,
     headless=True,
+    instance_label=None,       # default to env / id-prefix
 ))
 ```
 
+Url is taken from `<pack_folder>/.cloud-sync/sync.json`; the caller is expected to have run `setup` or `init` beforehand (or to write sync.json themselves via `cloud_sync.config.write(...)`).
+
 frazclient's `client.py` consumes this directly via `import cloud_sync` instead of subprocessing the pyz.
 
 ## On-disk layout