Initial SyncGames tree: agent, Android, deploy, docs.

Session-gated MinIO save sync with AppImage GUI, CLI edit/session flow, and Gitea release helper.

Co-authored-by: Cursor <[email protected]>

docs/planning/02-path3-implementation.md

@@ -0,0 +1,44 @@
+# Path 3 implementation plan (canonical copy)
+
+This is the human-readable archive of the Path 3 plan. The Cursor export snapshot lives beside this file.
+
+## Locked decisions
+
+| Decision | Choice |
+|----------|--------|
+| Primary | Path 3 — MinIO SSOT + session agents |
+| Linux agent | Python CLI/daemon |
+| Android | Kotlin + Jetpack Compose light UI |
+| Remote access | WAN via Cloudflare (paid domain); no VPN |
+| Ingress | Cloudflare → Tunnel → NGINX → MinIO |
+| Fallback | Path 1 (Syncthing on SSOT tree only) |
+| Planning | `docs/planning/` |
+
+## Session ops
+
+1. `start_session`: acquire lease → download `live/` → install to native paths → record WIP parent hash
+2. `end_session`: ensure game idle → copy native → WIP → upload history → promote `live/` → update meta → release lease → prune
+3. `restore`: copy chosen history prefix → `live/` (explicit)
+4. `add` / `remove`: TOML + bucket prefixes / archive to `retired/`
+
+## Object keys
+
+```
+games/<id>/live/<relative-save-path>
+games/<id>/history/<device>/<iso-ts>/<relative-save-path>
+games/<id>/meta.json
+```
+
+## CLI
+
+```
+syncgames add|remove|start|end|status|history|restore|doctor
+```
+
+## NGINX note
+
+Treat MinIO as an S3 API vhost: preserve Host for SigV4, disable request buffering, large `client_max_body_size`, no `auth_basic` on S3 (use Cloudflare Access + MinIO keys). See `docs/nas-minio-cloudflare.md`.
+
+## Out of scope (v1)
+
+Path 2 Gitea, Windows-native agent, automatic binary merge, continuous sync of live game dirs.