pivot to Python: replace Kotlin/JVM with stdlib zipapp

Reasons stacked up:
  - AV: unsigned JARs that auto-download binaries + upload files trigger
    Windows Defender false-positives more often than Python scripts
    invoked by code-signed python.exe.
  - Qt UI option: PySide6 opens a path to a real Qt UI (matching Prism's
    look) if needed later. JVM Qt bindings are abandoned.
  - frazclient already needs Python; inlining as 'import cloud_sync' is
    zero overhead vs the launcher always shelling out to java.

Implementation:
  - cloud_sync package: cli.py (argparse), creds.py, scope.py,
    restic.py (binary discovery + auto-download + sha256 verify),
    sync.py (pull/push subprocess restic).
  - pyproject.toml with hatchling backend; pip-installable.
  - Makefile builds cloud-sync.pyz via python -m zipapp (~53 KB).
  - 33 pytest tests, stdlib only on runtime.
  - CI workflow runs pytest matrix (3.10/3.11/3.12) + builds pyz.
  - DESIGN.md + README.md updated to reflect Python.

E2E verified against local restic-rest-server:
  pull empty → push initial → rm -rf local → pull restores → modify+push
  creates second snapshot → client forget --prune blocked by --append-only.

Throws away ~565 LOC of Kotlin (and 18 jar tests) committed earlier in
this same session. Net result is ~250 LOC Python + 33 tests = smaller
and more aligned with the rest of the stack.

cloud_sync/cli.py

@@ -0,0 +1,102 @@
+"""CLI parsing + entry point dispatch.
+
+Flag style mirrors packwiz-installer-bootstrap so operators wiring Prism's
+PreLaunch/PostExit hooks don't relearn the surface. Supports both
+``--url value`` and ``--url=value`` forms.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class Args:
+    """Parsed CLI args shared by both pull + push subcommands."""
+
+    url: str
+    pack_folder: Path
+    token_file: Path
+    restic_binary: Path | None  # None → auto-discover
+    allow_download: bool
+    headless: bool
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="cloud-sync",
+        description="Per-user Minecraft state sync via restic.",
+    )
+    p.add_argument("--version", action="version", version="cloud-sync 0.1.0")
+
+    sub = p.add_subparsers(dest="cmd", required=True)
+    for name in ("pull", "push"):
+        sp = sub.add_parser(name, help=f"{name} player state")
+        sp.add_argument(
+            "--url", required=True,
+            help="cloud-svc data plane URL (e.g. https://cloud.tm.center)",
+        )
+        sp.add_argument(
+            "--pack-folder", default=".", type=Path,
+            help="Minecraft instance directory (default: cwd)",
+        )
+        sp.add_argument(
+            "--token-file", default=None, type=Path,
+            help="Token file path (default: <pack-folder>/.cloud-sync/token)",
+        )
+        sp.add_argument(
+            "--restic-binary", default=None, type=Path,
+            help="Path to a restic binary; overrides auto-discovery",
+        )
+        sp.add_argument(
+            "--no-download", action="store_true",
+            help="Don't auto-fetch restic from upstream; fail if not found locally",
+        )
+        sp.add_argument(
+            "-g", "--no-gui", action="store_true",
+            help="Headless mode (no Swing/Qt windows, restic stdout only)",
+        )
+    return p
+
+
+def parse(argv: list[str]) -> tuple[str, Args]:
+    """Parse argv → (subcommand, Args). Raises SystemExit on error/help."""
+    ns = build_parser().parse_args(argv)
+    pack = Path(ns.pack_folder).absolute().resolve()
+    token = (
+        Path(ns.token_file).absolute()
+        if ns.token_file is not None
+        else pack / ".cloud-sync" / "token"
+    )
+    return ns.cmd, Args(
+        url=ns.url,
+        pack_folder=pack,
+        token_file=token,
+        restic_binary=Path(ns.restic_binary).absolute() if ns.restic_binary else None,
+        allow_download=not ns.no_download,
+        headless=ns.no_gui,
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    """CLI entrypoint. Returns exit code (0=ok, 1=user cancel, 2=error)."""
+    # Import here to keep CLI import light (test isolation).
+    from . import sync
+
+    try:
+        cmd, args = parse(sys.argv[1:] if argv is None else argv)
+    except SystemExit as e:
+        return int(e.code) if isinstance(e.code, int) else 2
+
+    action = {"pull": sync.pull, "push": sync.push}[cmd]
+    try:
+        return action(args)
+    except KeyboardInterrupt:
+        print("cloud-sync: cancelled", file=sys.stderr)
+        return 1
+    except Exception as e:  # noqa: BLE001
+        print(f"cloud-sync {cmd}: {e}", file=sys.stderr)
+        return 2