feat: opt-in by sync.json + per-instance ULID + restic subpath

Reshapes the launcher integration around two ideas:

  1. ONE global Prism PreLaunch/PostExit hook is enough for all
     instances. Wire it once at Settings > Default > Custom commands:

         python /opt/cloud-sync.pyz pull --pack-folder=$INST_MC_DIR
         python /opt/cloud-sync.pyz push --pack-folder=$INST_MC_DIR

     Instances WITHOUT .cloud-sync/sync.json are silent no-ops (rc=0,
     no UI, no banner). The opt-in probe runs BEFORE the UI factory
     so Prism's launch log stays clean for non-sync instances.

  2. Per-instance opt-in via 'setup' / 'init' subcommands that mint a
     fresh ULID-style instance_id + write sync.json (mode 644) and
     token (mode 600). 'disable' removes sync.json; cloud data
     untouched.

Restic URL gains an /<instance_id>/ subpath under the user's
namespace, so two Prism instances of the same Discord user no longer
share a snapshot timeline. --private-repos still gates on the first
path segment (the username); deeper segments are user-controlled,
so this works without server-side coordination. First-push-on-a-new-
instance probes via 'restic cat config' and 'init's the per-instance
repo if absent.

UI label resolution is runtime-only (NEVER stored in sync.json) so
the user renaming the Prism instance just propagates through on
next launch:

    --instance-label  >  $INST_NAME  >  $INST_ID  >  instance_id[:8]

Schema bumps:
  state.json schema: 1 -> 2, adds instance_id field. Schema-1 files
  are treated as missing (existing test1 user re-pulls fresh).
  sync.json schema: 1 (new file).

CLI rework:
  pull / push   no --url; load everything from sync.json
  setup         interactive: Qt login dialog for token; URL prompt
                if --url omitted; falls back to stdin when headless
  init          non-interactive setup; for scripted callers
  disable       rm sync.json

Args dataclass: drops 'url', adds 'instance_label'. cli.parse() now
returns (cmd, Namespace); a separate args_from(ns) builds the Args
so each subcommand can pluck the bits it needs from the Namespace
without forcing a 'one Args fits all subcommands' shape.

73 tests green; pyz 75 KB.

Smoke-verified locally:
  - pull/push on a folder without sync.json: silent rc=0, no banner
  - init writes sync.json (644) + token (600) with correct contents
  - disable removes sync.json, keeps token
  - mint produces unique 26-char base32 instance_ids
  - label resolution chain (flag > INST_NAME > INST_ID > prefix)

tests/test_state.py

@@ -27,14 +27,22 @@ def test_read_missing_returns_none(tmp_path: Path):
     assert statemod.read(tmp_path) is None
 
 
+_IID = "01H7XJ4WB2KD5MNCYV8RQ6PTAZ"
+
+
 def test_write_then_read_roundtrip(tmp_path: Path):
     dt = datetime(2026, 6, 5, 12, 34, 56, tzinfo=timezone.utc)
     statemod.write(
         tmp_path,
-        statemod.State(last_pulled_snapshot_id="abc123", last_pulled_at=dt),
+        statemod.State(
+            instance_id=_IID,
+            last_pulled_snapshot_id="abc123",
+            last_pulled_at=dt,
+        ),
     )
     got = statemod.read(tmp_path)
     assert got is not None
+    assert got.instance_id == _IID
     assert got.last_pulled_snapshot_id == "abc123"
     assert got.last_pulled_at == dt
 
@@ -43,6 +51,7 @@ def test_write_sets_mode_600(tmp_path: Path):
     statemod.write(
         tmp_path,
         statemod.State(
+            instance_id=_IID,
             last_pulled_snapshot_id="x",
             last_pulled_at=datetime.now(timezone.utc),
         ),
@@ -56,6 +65,7 @@ def test_clear_idempotent(tmp_path: Path):
     statemod.write(
         tmp_path,
         statemod.State(
+            instance_id=_IID,
             last_pulled_snapshot_id="x",
             last_pulled_at=datetime.now(timezone.utc),
         ),
@@ -68,9 +78,24 @@ def test_clear_idempotent(tmp_path: Path):
 def test_wrong_schema_returns_none(tmp_path: Path):
     p = tmp_path / ".cloud-sync" / "state.json"
     p.parent.mkdir(parents=True)
-    p.write_text(
-        json.dumps({"schema": 999, "last_pulled_snapshot_id": "x", "last_pulled_at": "2026-01-01T00:00:00Z"})
-    )
+    p.write_text(json.dumps({
+        "schema": 999, "instance_id": _IID,
+        "last_pulled_snapshot_id": "x",
+        "last_pulled_at": "2026-01-01T00:00:00Z",
+    }))
+    assert statemod.read(tmp_path) is None
+
+
+def test_schema_v1_returns_none(tmp_path: Path):
+    """Old schema-1 state.json (no instance_id) is treated as missing on
+    read. Triggers a fresh sync flow after the schema bump migration."""
+    p = tmp_path / ".cloud-sync" / "state.json"
+    p.parent.mkdir(parents=True)
+    p.write_text(json.dumps({
+        "schema": 1,
+        "last_pulled_snapshot_id": "x",
+        "last_pulled_at": "2026-01-01T00:00:00Z",
+    }))
     assert statemod.read(tmp_path) is None