feat(14-03): cache settings/status API and security tests

- api/cloud/cache.py: GET /analysis/cache, PATCH /analysis/cache/settings
- api/cloud/analysis.py: analysis router aggregator (Phase 14 parent)
- schemas.py: CacheStatusOut, CacheSettingsUpdateRequest (explicit allowlists)
- __init__.py: register analysis_router under /api/cloud
- 7 new security tests: admin block, unauthenticated block, object_key exclusion,
  response structure, enum validation, tier cap enforcement (T-14-01..02, T-14-08)
- All 47 plan target tests pass (test_cloud_cache.py + test_cloud_security.py)

backend/api/cloud/__init__.py

@@ -17,6 +17,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from api.cloud.connections import router as connections_router, _VALID_BACKENDS
 from api.cloud.browse import router as browse_router
 from api.cloud.operations import router as operations_router
+from api.cloud.analysis import router as analysis_router
 from db.models import User
 from deps.auth import get_regular_user
 from deps.db import get_db
@@ -26,6 +27,7 @@ router = APIRouter(prefix="/api/cloud", tags=["cloud"])
 router.include_router(connections_router)
 router.include_router(browse_router)
 router.include_router(operations_router)
+router.include_router(analysis_router)
 
 # ── Users router (default storage) ───────────────────────────────────────────