feat: local browser saves with opt-in cloud sync behind saves.cloud permission

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

backend/migrations/versions/0004_cloud_saves_permission.py

@@ -0,0 +1,18 @@
+"""Cloud saves became an explicit permission; keep them for existing system roles."""
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0004"
+down_revision = "0003"
+branch_labels = depends_on = None
+
+
+def upgrade():
+    op.get_bind().execute(sa.text(
+        "UPDATE roles SET permissions = array_append(permissions, 'saves.cloud') "
+        "WHERE is_system AND name IN ('moderator', 'player') AND NOT ('saves.cloud' = ANY(permissions))"))
+
+
+def downgrade():
+    op.get_bind().execute(sa.text(
+        "UPDATE roles SET permissions = array_remove(permissions, 'saves.cloud')"))