Phase 4: cloud backend — licensing, heartbeat, site management

- New cloud_backend/ FastAPI service on port 8001 (SQLite for dev, swappable to PostgreSQL)
- Endpoints: sysadmin auth (JWT), site registration, lock/unlock, heartbeat (X-Site-ID + X-Site-Key headers)
- Default sysadmin seeded on first startup from ADMIN_USERNAME/ADMIN_PASSWORD env vars
- cloud_backend added to docker-compose.yml with persistent data volume at ./data/cloud/
- local_backend cloud_sync.py updated to use correct /api/heartbeat/ endpoint with header auth
- local_backend config.py: added SITE_KEY setting
- Smoke tested: login, register site, heartbeat, lock, unlock, list all pass

cloud_backend/.env.example

@@ -0,0 +1,14 @@
+# Cloud Backend — copy this to .env and fill in values
+
+# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+SECRET_KEY=change-me-generate-a-long-random-string
+
+# SQLite for local dev. Switch to postgresql://user:pass@host/dbname for VPS.
+DATABASE_URL=sqlite:////app/data/cloud.db
+
+# JWT expiry in minutes
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+
+# Default sysadmin credentials (created on first startup if admin table is empty)
+ADMIN_USERNAME=sysadmin
+ADMIN_PASSWORD=changeme