feat: 'disable' renames to sync.json.disabled; new 'enable' rename-back

Pause/resume sync without losing the instance_id.

  disable  sync.json -> sync.json.disabled
  enable   sync.json.disabled -> sync.json

Re-enabling preserves the original ULID + url so the same restic
repo continues. No new instance_id minted, no orphaned snapshot
history. Tradeoff vs the previous 'disable = delete' semantics:
the on-disk artifact survives, so a truly fresh start now needs
'disable && rm sync.json.disabled' before 'setup'.

Implementation:

  config.disable(pack)  os.rename(sync.json -> sync.json.disabled).
                        False if no sync.json.
  config.enable(pack)   os.rename(sync.json.disabled -> sync.json).
                        Refuses if sync.json already exists
                        (caller must disable first).
  config.delete(pack)   now sweeps BOTH forms (escape hatch / tests).

setup_flow gains a precheck: if sync.json.disabled is present, point
the user at 'enable' instead of silently minting a fresh ULID over
their existing instance.

Opt-in gate (cfgmod.exists) is unchanged — only literal sync.json
counts. The .disabled sibling is invisible to pull/push, so the
silent-no-op behavior for paused instances Just Works.

cli adds 'enable' subcommand alongside 'disable'. _run_disable prints
'already disabled' when called twice; _run_enable refuses to clobber
an active config (exits 2 with the FileExistsError message).

7 new tests for disable/enable behavior + edge cases (idempotency,
nothing-to-X, refuse-clobber). 80 tests total.

tests/test_config.py

@@ -72,6 +72,63 @@ def test_delete_returns_false_when_missing(tmp_path: Path):
     assert cfgmod.delete(tmp_path) is False
 
 
+def test_delete_also_clears_disabled_sibling(tmp_path: Path):
+    """Hard delete sweeps both active + disabled forms — used by tests
+    and as an escape hatch when the user wants a truly clean slate."""
+    cfg = cfgmod.mint("https://x")
+    cfgmod.write(tmp_path, cfg)
+    cfgmod.disable(tmp_path)  # now only .disabled exists
+    cfgmod.write(tmp_path, cfgmod.mint("https://y"))  # also active
+    assert cfgmod.config_path(tmp_path).exists()
+    assert cfgmod.disabled_path(tmp_path).exists()
+    assert cfgmod.delete(tmp_path) is True
+    assert not cfgmod.config_path(tmp_path).exists()
+    assert not cfgmod.disabled_path(tmp_path).exists()
+
+
+# ---- disable / enable round-trip ----
+
+
+def test_disable_renames_to_disabled(tmp_path: Path):
+    cfg = cfgmod.mint("https://x")
+    cfgmod.write(tmp_path, cfg)
+    assert cfgmod.disable(tmp_path) is True
+    assert not cfgmod.config_path(tmp_path).exists()
+    assert cfgmod.disabled_path(tmp_path).exists()
+    # opt-in gate now reads "off"
+    assert cfgmod.exists(tmp_path) is False
+
+
+def test_disable_returns_false_when_nothing_to_disable(tmp_path: Path):
+    assert cfgmod.disable(tmp_path) is False
+
+
+def test_enable_restores(tmp_path: Path):
+    cfg = cfgmod.mint("https://x")
+    cfgmod.write(tmp_path, cfg)
+    cfgmod.disable(tmp_path)
+    assert cfgmod.enable(tmp_path) is True
+    got = cfgmod.read(tmp_path)
+    assert got is not None
+    assert got.instance_id == cfg.instance_id  # same id preserved!
+    assert got.url == cfg.url
+    assert not cfgmod.disabled_path(tmp_path).exists()
+
+
+def test_enable_returns_false_when_nothing_disabled(tmp_path: Path):
+    assert cfgmod.enable(tmp_path) is False
+
+
+def test_enable_refuses_to_clobber_active(tmp_path: Path):
+    """If both sync.json AND sync.json.disabled exist (manual mess),
+    enable refuses rather than silently overwriting the active one."""
+    cfgmod.write(tmp_path, cfgmod.mint("https://x"))
+    cfgmod.disable(tmp_path)
+    cfgmod.write(tmp_path, cfgmod.mint("https://y"))  # fresh active
+    with pytest.raises(FileExistsError):
+        cfgmod.enable(tmp_path)
+
+
 def test_corrupt_json_returns_none(tmp_path: Path):
     cfg_path = cfgmod.config_path(tmp_path)
     cfg_path.parent.mkdir(parents=True)