Phase 4: cloud backend — licensing, heartbeat, site management

- New cloud_backend/ FastAPI service on port 8001 (SQLite for dev, swappable to PostgreSQL)
- Endpoints: sysadmin auth (JWT), site registration, lock/unlock, heartbeat (X-Site-ID + X-Site-Key headers)
- Default sysadmin seeded on first startup from ADMIN_USERNAME/ADMIN_PASSWORD env vars
- cloud_backend added to docker-compose.yml with persistent data volume at ./data/cloud/
- local_backend cloud_sync.py updated to use correct /api/heartbeat/ endpoint with header auth
- local_backend config.py: added SITE_KEY setting
- Smoke tested: login, register site, heartbeat, lock, unlock, list all pass

local_backend/config.py

@@ -15,6 +15,7 @@ else:
 
 class Settings(BaseSettings):
     SITE_ID: str = ""
+    SITE_KEY: str = ""
     CLOUD_URL: str = ""
     SECRET_KEY: str = "change-me-generate-a-long-random-string"
     LICENSE_GRACE_HOURS: int = 24

local_backend/services/cloud_sync.py

@@ -46,8 +46,12 @@ async def _sync_once():
     try:
         async with httpx.AsyncClient(timeout=10) as client:
             resp = await client.post(
-                f"{settings.CLOUD_URL}/api/sites/heartbeat",
-                json={"site_id": settings.SITE_ID},
+                f"{settings.CLOUD_URL}/api/heartbeat/",
+                headers={
+                    "X-Site-ID": settings.SITE_ID,
+                    "X-Site-Key": settings.SITE_KEY,
+                },
+                json={"version": "1.0.0", "uptime_seconds": 0},
             )
             resp.raise_for_status()
             data = resp.json()