Initial ssr repository

Convert the legacy system_sync.sh and system_restore.sh into a modular
shareable repository:

- bin/ssr CLI dispatcher with install/sync/restore/schedule/config/status
- lib/ split: common, cloud, brew, mackup, macos
- Cloud provider abstraction (icloud, dropbox, googledrive, onedrive, custom)
- launchd template for scheduled daily sync (renderable via sed)
- ssr.conf.example with whitelisted KEY=VALUE config loader
- macos-defaults.sh extracted from inline block, overridable
- install.sh bootstrap symlinks CLI into ~/.local/bin
- README with usage, config table, migration map, security notes
- Original scripts archived under legacy/ for reference

Fixes vs originals: set -euo pipefail, quoted vars, find -print0,
spctl --global-disable (was --master-disable), MACOS=".macos" bug,
zero-width char before ln, Apple Silicon brew shellenv, config injection
hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-status

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# ssr-status — print current state: config, cloud target, last sync, schedule.
+
+set -euo pipefail
+SSR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=../lib/common.sh
+source "$SSR_ROOT/lib/common.sh"
+# shellcheck source=../lib/cloud.sh
+source "$SSR_ROOT/lib/cloud.sh"
+
+ssr::load_config
+
+cfg="${SSR_CONFIG:-$HOME/.config/ssr/ssr.conf}"
+provider="${SSR_CLOUD_PROVIDER:-icloud}"
+
+echo "ssr status"
+echo "  repo:       $SSR_ROOT"
+echo "  config:     $cfg $([[ -f "$cfg" ]] && echo '(present)' || echo '(missing)')"
+echo "  provider:   $provider"
+
+if cloud_dir="$(ssr::cloud::resolve_dir 2>/dev/null)"; then
+    echo "  cloud dir:  $cloud_dir $([[ -d "$cloud_dir" ]] && echo '(ok)' || echo '(unreachable)')"
+    echo "  backup dir: $(ssr::cloud::backup_dir 2>/dev/null || echo 'n/a')"
+fi
+
+state_dir="${SSR_STATE_DIR:-$HOME/.local/state/ssr}"
+if [[ -f "$state_dir/last-sync" ]]; then
+    echo "  last sync:  $(cat "$state_dir/last-sync")"
+else
+    echo "  last sync:  never"
+fi
+
+label="${SSR_LAUNCHD_LABEL:-de.surke.ssr.sync}"
+if launchctl list 2>/dev/null | grep -q "$label"; then
+    echo "  schedule:   active ($label)"
+else
+    echo "  schedule:   inactive"
+fi