rename: cloud sync -> instance sync; cloud -> Timemachine Network; drop Tk

Product / UI / CLI / docs rebrand. Internal package, repo, and
on-disk dir names stay 'cloud_sync' / 'cloud-sync' / '.cloud-sync/'
to avoid breaking existing installs; a future commit can do the
file-system rename when the cost is worth paying.

User-facing changes:
  CLI prog name:        cloud-sync     -> instance-sync
  CLI description:      cloud-svc URL  -> Timemachine Network endpoint
  Dialog title:         CLOUD SYNC     -> INSTANCE SYNC
  Dialog title:         CLOUD CONFLICT -> INSTANCE CONFLICT
  Dialog title:         CONNECT CLOUD SAVE -> CONNECT TO THE NETWORK
  Card label:           Cloud Save     -> Remote Save
  Skip button:          Skip cloud sync -> Skip instance sync
  Body copy:            'the cloud'    -> 'the Timemachine Network'
  Window titles:        Cloud sync — ... -> Instance sync — ...
  Log prefix:           cloud-sync:    -> instance-sync:
  Error prose:          'cloud-sync token' -> 'instance-sync token'

Backend changes:
  restic --host tag:    cloud-sync     -> instance-sync
  State.host_tag dflt:  cloud-sync     -> instance-sync
  (Existing snapshots with the old tag still pull fine; we use 'latest'.)

Drop tkinter fallback: ui.py now offers Qt OR Headless. tkinter is
unnecessary given we already maintain Qt + headless; one less code
path to keep styled, smaller pyz. make_progress() picks Qt first,
falls through to HeadlessProgress on ImportError with a stderr hint
to 'pip install PySide6'.

README: rebrand title + prose; note repo/dir rename deferred; call
out the PySide6 install step. Conflict/login dialogs are now Qt-only;
without Qt, conflict aborts (defensive) and login tells the user to
paste the token manually.

52 tests green; no test-file label changes needed since they only
exercise internal APIs.

cloud_sync/creds.py

@@ -3,8 +3,9 @@
 Format: ``discord_id:password`` on a single line. Whitespace tolerated.
 The Discord ID is the URL path segment under cloud.tm.center/<id>/ that
 restic-rest-server's --private-repos enforces against the basic-auth
-username. The password is the bcrypt'd entry's plaintext AND the restic
-repo encryption password (cloud-svc provisions one password covering both).
+username. The password is the bcrypt'd entry's plaintext — it covers HTTP
+basic auth only (restic repos use --insecure-no-password). The Timemachine
+Network control plane provisions the credential at /register time.
 """
 
 from __future__ import annotations
@@ -19,14 +20,14 @@ class CredentialsError(Exception):
 def read_credentials(token_file: Path) -> tuple[str, str]:
     if not token_file.exists():
         raise CredentialsError(
-            f"cloud-sync token not found at {token_file}. "
+            f"instance-sync token not found at {token_file}. "
             f"After /register in Discord you should have received credentials; "
             f"paste them into this file as 'discord_id:password' on one line."
         )
     raw = token_file.read_text(encoding="utf-8").strip()
     if ":" not in raw:
         raise CredentialsError(
-            f"cloud-sync token at {token_file} malformed "
+            f"instance-sync token at {token_file} malformed "
             f"(expected 'discord_id:password' on one line)"
         )
     discord_id, password = raw.split(":", 1)
@@ -34,7 +35,7 @@ def read_credentials(token_file: Path) -> tuple[str, str]:
     password = password.strip()
     if not discord_id or not password:
         raise CredentialsError(
-            f"cloud-sync token at {token_file} malformed "
+            f"instance-sync token at {token_file} malformed "
             f"(empty discord_id or password)"
         )
     return discord_id, password