Roadmap: cloud saves, desktop and web both ways (a Cloudflare Worker, a name and password, the newer-copy check)

docs/ROADMAP.md

@@ -140,6 +140,36 @@ phases M2.0-M2.7).
     another host) or be split.
   - *Size of the job:* one step to build it and see how it runs, another to
     fix the water, tune the graphics and controls, and put it on the page.
+- **Cloud saves** (Paul, Nov 2026: with the web version, and useful before
+  it, desktop to desktop): carry a single-player world between the desktop
+  game and the browser, **both ways**.
+  - *In the game:* pause menu **Save to cloud** (a cloud name and a password
+    the first time; after that it can upload on each save: autosave, sleep,
+    quit); title screen **Load from cloud** (name and password, pick a
+    world, it downloads and you carry on). What travels: the world folder
+    (`meta.json`, `world.json`), its explored map (`maps/`), and which of
+    Old Tam's tips you've seen. Not online worlds (they live on their server).
+  - *Size:* a world is 8-32 KB on disk, a few KB compressed: uploads are
+    instant and storage is next to free.
+  - *Where:* a Cloudflare Worker beside the site (`/api/...`), saves in R2
+    (or D1). Free tier is plenty. (Paul's own server would do, but is one
+    more service to keep running.)
+  - *Safety:* passwords never stored, only a salted hash (PBKDF2, WebCrypto
+    in the Worker); HTTPS only; wrong guesses lock a name out for a while;
+    a size cap and a world count per name. Option: encrypt the save with
+    the password in the game before upload, so the server holds only
+    ciphertext (but a forgotten password loses the cloud copy; the local
+    copy is unaffected).
+  - *Playing in two places:* each upload carries a counter. If the cloud's
+    copy is newer than the one you last downloaded, the game asks ("The
+    cloud has a newer save (from the web, 20 minutes ago): use that, or
+    keep this one?") instead of overwriting it.
+  - *Versions:* the same save format on desktop and web; a save from a
+    newer version than the game says so rather than loading it badly.
+  - *Size of the job:* one step for the Worker and storage (with tests), one
+    for the game side (name and password, the buttons, the newer-copy
+    question). Paul creates the Worker and its storage in his Cloudflare
+    account; the code and setup steps come with it.
 - **Later, maybe:** Android tablets (Nov 2026: left for now). Most input is
   already named actions, so a touch layer (stick, look, contextual buttons)
   is possible; the Mobile renderer has the same lost effects as the web, and