pivot to Python: replace Kotlin/JVM with stdlib zipapp

Reasons stacked up:
  - AV: unsigned JARs that auto-download binaries + upload files trigger
    Windows Defender false-positives more often than Python scripts
    invoked by code-signed python.exe.
  - Qt UI option: PySide6 opens a path to a real Qt UI (matching Prism's
    look) if needed later. JVM Qt bindings are abandoned.
  - frazclient already needs Python; inlining as 'import cloud_sync' is
    zero overhead vs the launcher always shelling out to java.

Implementation:
  - cloud_sync package: cli.py (argparse), creds.py, scope.py,
    restic.py (binary discovery + auto-download + sha256 verify),
    sync.py (pull/push subprocess restic).
  - pyproject.toml with hatchling backend; pip-installable.
  - Makefile builds cloud-sync.pyz via python -m zipapp (~53 KB).
  - 33 pytest tests, stdlib only on runtime.
  - CI workflow runs pytest matrix (3.10/3.11/3.12) + builds pyz.
  - DESIGN.md + README.md updated to reflect Python.

E2E verified against local restic-rest-server:
  pull empty → push initial → rm -rf local → pull restores → modify+push
  creates second snapshot → client forget --prune blocked by --append-only.

Throws away ~565 LOC of Kotlin (and 18 jar tests) committed earlier in
this same session. Net result is ~250 LOC Python + 33 tests = smaller
and more aligned with the rest of the stack.

tests/test_repo_url.py

@@ -0,0 +1,54 @@
+"""restic repo URL builder + env tests."""
+
+from __future__ import annotations
+
+import pytest
+
+from cloud_sync.sync import _restic_env, _restic_repo
+
+
+def test_basic_http_url():
+    repo = _restic_repo("http://cloud.tm.center", "12345", "secretpw")
+    assert repo == "rest:http://12345:secretpw@cloud.tm.center/12345/"
+
+
+def test_https_url():
+    repo = _restic_repo("https://cloud.tm.center", "12345", "pw")
+    assert repo == "rest:https://12345:pw@cloud.tm.center/12345/"
+
+
+def test_trailing_slash_stripped():
+    repo = _restic_repo("https://cloud.tm.center/", "12345", "pw")
+    assert repo == "rest:https://12345:pw@cloud.tm.center/12345/"
+
+
+def test_url_with_port():
+    repo = _restic_repo("http://127.0.0.1:8002", "alice", "pw")
+    assert repo == "rest:http://alice:pw@127.0.0.1:8002/alice/"
+
+
+def test_rest_prefix_stripped_if_supplied():
+    repo = _restic_repo("rest:http://x.test", "u", "p")
+    assert repo == "rest:http://u:p@x.test/u/"
+
+
+def test_password_with_special_chars_encoded():
+    repo = _restic_repo("http://x.test", "u", "p@ss/word?!&")
+    # URL-encoded form of "p@ss/word?!&"
+    assert "p%40ss%2Fword%3F%21%26@x.test" in repo
+
+
+def test_user_with_special_chars_encoded():
+    repo = _restic_repo("http://x.test", "u/with@chars", "pw")
+    assert "u%2Fwith%40chars" in repo
+
+
+def test_missing_scheme_rejected():
+    with pytest.raises(ValueError):
+        _restic_repo("cloud.tm.center", "u", "p")
+
+
+def test_env_contains_password():
+    env = _restic_env("hunter2")
+    assert env["RESTIC_PASSWORD"] == "hunter2"
+    assert "RESTIC_PROGRESS_FPS" in env