pivot to Python: replace Kotlin/JVM with stdlib zipapp

Reasons stacked up:
  - AV: unsigned JARs that auto-download binaries + upload files trigger
    Windows Defender false-positives more often than Python scripts
    invoked by code-signed python.exe.
  - Qt UI option: PySide6 opens a path to a real Qt UI (matching Prism's
    look) if needed later. JVM Qt bindings are abandoned.
  - frazclient already needs Python; inlining as 'import cloud_sync' is
    zero overhead vs the launcher always shelling out to java.

Implementation:
  - cloud_sync package: cli.py (argparse), creds.py, scope.py,
    restic.py (binary discovery + auto-download + sha256 verify),
    sync.py (pull/push subprocess restic).
  - pyproject.toml with hatchling backend; pip-installable.
  - Makefile builds cloud-sync.pyz via python -m zipapp (~53 KB).
  - 33 pytest tests, stdlib only on runtime.
  - CI workflow runs pytest matrix (3.10/3.11/3.12) + builds pyz.
  - DESIGN.md + README.md updated to reflect Python.

E2E verified against local restic-rest-server:
  pull empty → push initial → rm -rf local → pull restores → modify+push
  creates second snapshot → client forget --prune blocked by --append-only.

Throws away ~565 LOC of Kotlin (and 18 jar tests) committed earlier in
this same session. Net result is ~250 LOC Python + 33 tests = smaller
and more aligned with the rest of the stack.

cloud_sync/scope.py

@@ -0,0 +1,84 @@
+"""Per-distribution sync scope (include/exclude paths).
+
+Each cloud-sync deployment ships its own ``scope.json`` that picks which
+files participate in sync. Lives at ``<pack-folder>/.cloud-sync/scope.json``.
+Defaults are baked in so a fresh install with no scope.json works.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+
+
+DEFAULT_INCLUDE: list[str] = [
+    "options.txt",
+    "optionsof.txt",
+    "optionsshaders.txt",
+    "config/",
+    "journeymap/data/",
+    "screenshots/",
+]
+
+DEFAULT_EXCLUDE: list[str] = [
+    ".cloud-sync/",         # never sync our own state dir
+    ".cloud-token",         # legacy location (pre-jar/pre-restic era)
+    "config/simple-mod-sync*",
+    "config/packwiz*",
+    "**/cache/",
+    "**/*.log",
+    "**/*.tmp",
+]
+
+
+@dataclass(frozen=True)
+class Scope:
+    include: list[str] = field(default_factory=lambda: list(DEFAULT_INCLUDE))
+    exclude: list[str] = field(default_factory=lambda: list(DEFAULT_EXCLUDE))
+
+
+def load(pack_folder: Path) -> Scope:
+    """Read scope.json or return defaults."""
+    path = pack_folder / ".cloud-sync" / "scope.json"
+    if not path.exists():
+        return Scope()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as e:
+        print(
+            f"cloud-sync: scope.json invalid ({e}); using defaults",
+            file=sys.stderr,
+        )
+        return Scope()
+    return Scope(
+        include=list(data.get("include", DEFAULT_INCLUDE)),
+        exclude=list(data.get("exclude", DEFAULT_EXCLUDE)),
+    )
+
+
+def materialize_for_restic(pack_folder: Path, scope: Scope) -> tuple[Path, Path]:
+    """Write files-from + exclude-from text files restic can consume.
+
+    Files include directories; restic recurses into them. Exclude patterns
+    are matched against file paths during the walk.
+    """
+    state_dir = pack_folder / ".cloud-sync"
+    state_dir.mkdir(parents=True, exist_ok=True)
+    files_from = state_dir / "files-from.txt"
+    exclude_from = state_dir / "exclude-from.txt"
+
+    files_from.write_text(
+        "\n".join(_trim_trailing_slash(p) for p in scope.include) + "\n",
+        encoding="utf-8",
+    )
+    exclude_from.write_text(
+        "\n".join(scope.exclude) + "\n",
+        encoding="utf-8",
+    )
+    return files_from, exclude_from
+
+
+def _trim_trailing_slash(s: str) -> str:
+    return s.rstrip("/") if s.endswith("/") else s