feat(14-03): cache settings/status API and security tests

- api/cloud/cache.py: GET /analysis/cache, PATCH /analysis/cache/settings
- api/cloud/analysis.py: analysis router aggregator (Phase 14 parent)
- schemas.py: CacheStatusOut, CacheSettingsUpdateRequest (explicit allowlists)
- __init__.py: register analysis_router under /api/cloud
- 7 new security tests: admin block, unauthenticated block, object_key exclusion,
  response structure, enum validation, tier cap enforcement (T-14-01..02, T-14-08)
- All 47 plan target tests pass (test_cloud_cache.py + test_cloud_security.py)

backend/api/cloud/analysis.py

@@ -0,0 +1,29 @@
+"""
+Cloud analysis API package — Phase 14 router aggregator.
+
+Provides the /analysis sub-router tree under /api/cloud.  All routes are
+owner-scoped and blocked for admin accounts (get_regular_user enforced at
+each leaf router).
+
+Currently registered routes:
+  GET  /analysis/cache          — cache usage/settings (cloud/cache.py)
+  PATCH /analysis/cache/settings — update settings    (cloud/cache.py)
+
+Future routes (Phase 14 plans 04-09):
+  POST  /analysis/connections/{id}/estimate
+  POST  /analysis/connections/{id}/jobs
+  GET   /analysis/jobs/{id}
+  POST  /analysis/jobs/{id}/cancel
+  POST  /analysis/jobs/{id}/items/{item_id}/skip
+
+Module is importable as api.cloud.analysis for tests and callers that verify
+router registration before endpoint implementation is complete.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+from api.cloud.cache import router as cache_router
+
+router = APIRouter()
+router.include_router(cache_router)