Phase 4: cloud backend — licensing, heartbeat, site management

- New cloud_backend/ FastAPI service on port 8001 (SQLite for dev, swappable to PostgreSQL)
- Endpoints: sysadmin auth (JWT), site registration, lock/unlock, heartbeat (X-Site-ID + X-Site-Key headers)
- Default sysadmin seeded on first startup from ADMIN_USERNAME/ADMIN_PASSWORD env vars
- cloud_backend added to docker-compose.yml with persistent data volume at ./data/cloud/
- local_backend cloud_sync.py updated to use correct /api/heartbeat/ endpoint with header auth
- local_backend config.py: added SITE_KEY setting
- Smoke tested: login, register site, heartbeat, lock, unlock, list all pass

cloud_backend/config.py

@@ -0,0 +1,17 @@
+from pathlib import Path
+from pydantic_settings import BaseSettings
+
+_HERE = Path(__file__).parent
+
+
+class Settings(BaseSettings):
+    SECRET_KEY: str = "change-me-generate-a-long-random-string"
+    DATABASE_URL: str = "sqlite:////app/data/cloud.db"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 60
+    ADMIN_USERNAME: str = "sysadmin"
+    ADMIN_PASSWORD: str = "changeme"
+
+    model_config = {"env_file": str(_HERE / ".env")}
+
+
+settings = Settings()