pivot to Python: replace Kotlin/JVM with stdlib zipapp

Reasons stacked up:
  - AV: unsigned JARs that auto-download binaries + upload files trigger
    Windows Defender false-positives more often than Python scripts
    invoked by code-signed python.exe.
  - Qt UI option: PySide6 opens a path to a real Qt UI (matching Prism's
    look) if needed later. JVM Qt bindings are abandoned.
  - frazclient already needs Python; inlining as 'import cloud_sync' is
    zero overhead vs the launcher always shelling out to java.

Implementation:
  - cloud_sync package: cli.py (argparse), creds.py, scope.py,
    restic.py (binary discovery + auto-download + sha256 verify),
    sync.py (pull/push subprocess restic).
  - pyproject.toml with hatchling backend; pip-installable.
  - Makefile builds cloud-sync.pyz via python -m zipapp (~53 KB).
  - 33 pytest tests, stdlib only on runtime.
  - CI workflow runs pytest matrix (3.10/3.11/3.12) + builds pyz.
  - DESIGN.md + README.md updated to reflect Python.

E2E verified against local restic-rest-server:
  pull empty → push initial → rm -rf local → pull restores → modify+push
  creates second snapshot → client forget --prune blocked by --append-only.

Throws away ~565 LOC of Kotlin (and 18 jar tests) committed earlier in
this same session. Net result is ~250 LOC Python + 33 tests = smaller
and more aligned with the rest of the stack.

tests/test_creds.py

@@ -0,0 +1,62 @@
+"""Token file parser tests."""
+
+from __future__ import annotations
+
+import pytest
+
+from cloud_sync.creds import CredentialsError, read_credentials
+
+
+def test_parses_one_liner(tmp_path):
+    t = tmp_path / "token"
+    t.write_text("358881557521498112:s3cret-pass\n")
+    discord_id, password = read_credentials(t)
+    assert discord_id == "358881557521498112"
+    assert password == "s3cret-pass"
+
+
+def test_trims_whitespace(tmp_path):
+    t = tmp_path / "token"
+    t.write_text("  123  :  pw  \n")
+    discord_id, password = read_credentials(t)
+    assert discord_id == "123"
+    assert password == "pw"
+
+
+def test_missing_file_raises_with_actionable_message(tmp_path):
+    missing = tmp_path / "missing-token"
+    with pytest.raises(CredentialsError) as exc:
+        read_credentials(missing)
+    assert "token not found" in str(exc.value)
+    assert "discord_id:password" in str(exc.value)
+
+
+def test_missing_colon_rejected(tmp_path):
+    t = tmp_path / "token"
+    t.write_text("no-colon-here")
+    with pytest.raises(CredentialsError) as exc:
+        read_credentials(t)
+    assert "malformed" in str(exc.value)
+
+
+def test_empty_id_rejected(tmp_path):
+    t = tmp_path / "token"
+    t.write_text(":password")
+    with pytest.raises(CredentialsError):
+        read_credentials(t)
+
+
+def test_empty_password_rejected(tmp_path):
+    t = tmp_path / "token"
+    t.write_text("123:")
+    with pytest.raises(CredentialsError):
+        read_credentials(t)
+
+
+def test_password_with_colon_kept_intact(tmp_path):
+    """Passwords containing : should be kept whole after the first split."""
+    t = tmp_path / "token"
+    t.write_text("123:pw:with:colons")
+    discord_id, password = read_credentials(t)
+    assert discord_id == "123"
+    assert password == "pw:with:colons"