feat: opt-in by sync.json + per-instance ULID + restic subpath

Reshapes the launcher integration around two ideas:

  1. ONE global Prism PreLaunch/PostExit hook is enough for all
     instances. Wire it once at Settings > Default > Custom commands:

         python /opt/cloud-sync.pyz pull --pack-folder=$INST_MC_DIR
         python /opt/cloud-sync.pyz push --pack-folder=$INST_MC_DIR

     Instances WITHOUT .cloud-sync/sync.json are silent no-ops (rc=0,
     no UI, no banner). The opt-in probe runs BEFORE the UI factory
     so Prism's launch log stays clean for non-sync instances.

  2. Per-instance opt-in via 'setup' / 'init' subcommands that mint a
     fresh ULID-style instance_id + write sync.json (mode 644) and
     token (mode 600). 'disable' removes sync.json; cloud data
     untouched.

Restic URL gains an /<instance_id>/ subpath under the user's
namespace, so two Prism instances of the same Discord user no longer
share a snapshot timeline. --private-repos still gates on the first
path segment (the username); deeper segments are user-controlled,
so this works without server-side coordination. First-push-on-a-new-
instance probes via 'restic cat config' and 'init's the per-instance
repo if absent.

UI label resolution is runtime-only (NEVER stored in sync.json) so
the user renaming the Prism instance just propagates through on
next launch:

    --instance-label  >  $INST_NAME  >  $INST_ID  >  instance_id[:8]

Schema bumps:
  state.json schema: 1 -> 2, adds instance_id field. Schema-1 files
  are treated as missing (existing test1 user re-pulls fresh).
  sync.json schema: 1 (new file).

CLI rework:
  pull / push   no --url; load everything from sync.json
  setup         interactive: Qt login dialog for token; URL prompt
                if --url omitted; falls back to stdin when headless
  init          non-interactive setup; for scripted callers
  disable       rm sync.json

Args dataclass: drops 'url', adds 'instance_label'. cli.parse() now
returns (cmd, Namespace); a separate args_from(ns) builds the Args
so each subcommand can pluck the bits it needs from the Namespace
without forcing a 'one Args fits all subcommands' shape.

73 tests green; pyz 75 KB.

Smoke-verified locally:
  - pull/push on a folder without sync.json: silent rc=0, no banner
  - init writes sync.json (644) + token (600) with correct contents
  - disable removes sync.json, keeps token
  - mint produces unique 26-char base32 instance_ids
  - label resolution chain (flag > INST_NAME > INST_ID > prefix)

tests/test_repo_url.py

@@ -7,45 +7,52 @@ import pytest
 from cloud_sync.sync import _restic_env, _restic_repo
 
 
+_IID = "01H7XJ4WB2KD5MNCYV8RQ6PTAZ"
+
+
 def test_basic_http_url():
-    repo = _restic_repo("http://cloud.tm.center", "12345", "secretpw")
-    assert repo == "rest:http://12345:secretpw@cloud.tm.center/12345/"
+    repo = _restic_repo("http://cloud.tm.center", "12345", "secretpw", _IID)
+    assert repo == f"rest:http://12345:secretpw@cloud.tm.center/12345/{_IID}/"
 
 
 def test_https_url():
-    repo = _restic_repo("https://cloud.tm.center", "12345", "pw")
-    assert repo == "rest:https://12345:pw@cloud.tm.center/12345/"
+    repo = _restic_repo("https://cloud.tm.center", "12345", "pw", _IID)
+    assert repo == f"rest:https://12345:pw@cloud.tm.center/12345/{_IID}/"
 
 
 def test_trailing_slash_stripped():
-    repo = _restic_repo("https://cloud.tm.center/", "12345", "pw")
-    assert repo == "rest:https://12345:pw@cloud.tm.center/12345/"
+    repo = _restic_repo("https://cloud.tm.center/", "12345", "pw", _IID)
+    assert repo == f"rest:https://12345:pw@cloud.tm.center/12345/{_IID}/"
 
 
 def test_url_with_port():
-    repo = _restic_repo("http://127.0.0.1:8002", "alice", "pw")
-    assert repo == "rest:http://alice:pw@127.0.0.1:8002/alice/"
+    repo = _restic_repo("http://127.0.0.1:8002", "alice", "pw", _IID)
+    assert repo == f"rest:http://alice:pw@127.0.0.1:8002/alice/{_IID}/"
 
 
 def test_rest_prefix_stripped_if_supplied():
-    repo = _restic_repo("rest:http://x.test", "u", "p")
-    assert repo == "rest:http://u:p@x.test/u/"
+    repo = _restic_repo("rest:http://x.test", "u", "p", _IID)
+    assert repo == f"rest:http://u:p@x.test/u/{_IID}/"
 
 
 def test_password_with_special_chars_encoded():
-    repo = _restic_repo("http://x.test", "u", "p@ss/word?!&")
-    # URL-encoded form of "p@ss/word?!&"
+    repo = _restic_repo("http://x.test", "u", "p@ss/word?!&", _IID)
     assert "p%40ss%2Fword%3F%21%26@x.test" in repo
 
 
 def test_user_with_special_chars_encoded():
-    repo = _restic_repo("http://x.test", "u/with@chars", "pw")
+    repo = _restic_repo("http://x.test", "u/with@chars", "pw", _IID)
     assert "u%2Fwith%40chars" in repo
 
 
+def test_instance_id_in_url_path():
+    repo = _restic_repo("http://x.test", "u", "p", _IID)
+    assert repo.endswith(f"/u/{_IID}/")
+
+
 def test_missing_scheme_rejected():
     with pytest.raises(ValueError):
-        _restic_repo("cloud.tm.center", "u", "p")
+        _restic_repo("cloud.tm.center", "u", "p", _IID)
 
 
 def test_env_does_not_contain_password():