feat: opt-in by sync.json + per-instance ULID + restic subpath

Reshapes the launcher integration around two ideas:

  1. ONE global Prism PreLaunch/PostExit hook is enough for all
     instances. Wire it once at Settings > Default > Custom commands:

         python /opt/cloud-sync.pyz pull --pack-folder=$INST_MC_DIR
         python /opt/cloud-sync.pyz push --pack-folder=$INST_MC_DIR

     Instances WITHOUT .cloud-sync/sync.json are silent no-ops (rc=0,
     no UI, no banner). The opt-in probe runs BEFORE the UI factory
     so Prism's launch log stays clean for non-sync instances.

  2. Per-instance opt-in via 'setup' / 'init' subcommands that mint a
     fresh ULID-style instance_id + write sync.json (mode 644) and
     token (mode 600). 'disable' removes sync.json; cloud data
     untouched.

Restic URL gains an /<instance_id>/ subpath under the user's
namespace, so two Prism instances of the same Discord user no longer
share a snapshot timeline. --private-repos still gates on the first
path segment (the username); deeper segments are user-controlled,
so this works without server-side coordination. First-push-on-a-new-
instance probes via 'restic cat config' and 'init's the per-instance
repo if absent.

UI label resolution is runtime-only (NEVER stored in sync.json) so
the user renaming the Prism instance just propagates through on
next launch:

    --instance-label  >  $INST_NAME  >  $INST_ID  >  instance_id[:8]

Schema bumps:
  state.json schema: 1 -> 2, adds instance_id field. Schema-1 files
  are treated as missing (existing test1 user re-pulls fresh).
  sync.json schema: 1 (new file).

CLI rework:
  pull / push   no --url; load everything from sync.json
  setup         interactive: Qt login dialog for token; URL prompt
                if --url omitted; falls back to stdin when headless
  init          non-interactive setup; for scripted callers
  disable       rm sync.json

Args dataclass: drops 'url', adds 'instance_label'. cli.parse() now
returns (cmd, Namespace); a separate args_from(ns) builds the Args
so each subcommand can pluck the bits it needs from the Namespace
without forcing a 'one Args fits all subcommands' shape.

73 tests green; pyz 75 KB.

Smoke-verified locally:
  - pull/push on a folder without sync.json: silent rc=0, no banner
  - init writes sync.json (644) + token (600) with correct contents
  - disable removes sync.json, keeps token
  - mint produces unique 26-char base32 instance_ids
  - label resolution chain (flag > INST_NAME > INST_ID > prefix)

cloud_sync/setup_flow.py

@@ -0,0 +1,123 @@
+"""Interactive (``setup``) + non-interactive (``init``) opt-in flow.
+
+Both end up doing the same thing — write a fresh sync.json + token to
+``<pack>/.cloud-sync/``. Difference is just how the URL + token get
+collected:
+
+  setup      Qt login dialog for token; URL prompted at stdin if not
+             supplied via ``--url`` flag. Falls back to all-stdin when
+             headless / Qt missing.
+  init       Both URL + token come from flags. No prompting. Suitable
+             for scripted CI runs or external launcher hooks (frazclient,
+             discord-bot ``/cloud register`` integration).
+
+This is the only path that creates sync.json; pull/push never auto-mint.
+That makes opt-in explicit — a player intentionally enables sync rather
+than being silently signed up the first time they launch an instance.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from . import config as cfgmod
+from .cli import Args
+
+
+def run(
+    args: Args,
+    url: str | None,
+    token: str | None,
+    interactive: bool,
+) -> int:
+    """Drive the opt-in flow. Returns CLI exit code (0/1/2)."""
+    pack = args.pack_folder
+    cfg_path = cfgmod.config_path(pack)
+
+    if cfgmod.exists(pack):
+        existing = cfgmod.read(pack)
+        if existing is not None:
+            print(
+                f"instance-sync: this instance is already sync-enabled\n"
+                f"  sync.json:   {cfg_path}\n"
+                f"  url:         {existing.url}\n"
+                f"  instance_id: {existing.instance_id}\n"
+                f"  created_at:  {existing.created_at}\n"
+                "Run with `disable` first if you want to re-enroll.",
+                file=sys.stderr,
+            )
+            return 2
+
+    if url is None:
+        if not interactive:
+            print(
+                "instance-sync: --url is required for `init`",
+                file=sys.stderr,
+            )
+            return 2
+        url = _prompt_url()
+        if not url:
+            return 1
+
+    if token is None:
+        token = _prompt_token(headless=args.headless or not interactive)
+        if token is None:
+            print("instance-sync: setup cancelled (no token)", file=sys.stderr)
+            return 1
+
+    if ":" not in token:
+        print(
+            "instance-sync: token must be discord_id:password",
+            file=sys.stderr,
+        )
+        return 2
+    head, _, tail = token.partition(":")
+    if not head.strip().isdigit() or not tail.strip():
+        print(
+            "instance-sync: token malformed (discord_id must be numeric, "
+            "password must be non-empty)",
+            file=sys.stderr,
+        )
+        return 2
+
+    cfg = cfgmod.mint(url=url.strip())
+    cfgmod.write(pack, cfg)
+
+    args.token_file.parent.mkdir(parents=True, exist_ok=True)
+    args.token_file.write_text(token.strip() + "\n", encoding="utf-8")
+    args.token_file.chmod(0o600)
+
+    print(
+        f"instance-sync: enabled\n"
+        f"  sync.json:   {cfg_path}\n"
+        f"  token:       {args.token_file}\n"
+        f"  url:         {cfg.url}\n"
+        f"  instance_id: {cfg.instance_id}"
+    )
+    return 0
+
+
+def _prompt_url() -> str:
+    """stdin prompt for the network endpoint."""
+    try:
+        v = input("Timemachine Network URL (e.g. https://cloud.tm.center): ").strip()
+        return v
+    except (EOFError, KeyboardInterrupt):
+        return ""
+
+
+def _prompt_token(headless: bool) -> str | None:
+    """Returns the discord_id:password token string, or None if user cancelled."""
+    if not headless:
+        try:
+            from .ui_qt import prompt_login_qt
+        except ImportError:
+            pass
+        else:
+            return prompt_login_qt()
+    # Headless fallback.
+    try:
+        return input("Paste token (discord_id:password): ").strip()
+    except (EOFError, KeyboardInterrupt):
+        return None