feat(14-03): cache settings/status API and security tests

- api/cloud/cache.py: GET /analysis/cache, PATCH /analysis/cache/settings
- api/cloud/analysis.py: analysis router aggregator (Phase 14 parent)
- schemas.py: CacheStatusOut, CacheSettingsUpdateRequest (explicit allowlists)
- __init__.py: register analysis_router under /api/cloud
- 7 new security tests: admin block, unauthenticated block, object_key exclusion,
  response structure, enum validation, tier cap enforcement (T-14-01..02, T-14-08)
- All 47 plan target tests pass (test_cloud_cache.py + test_cloud_security.py)

backend/api/cloud/schemas.py

@@ -9,6 +9,10 @@ Phase 13 additions:
   - ReconnectOut: typed reconnect response (CONN-01..03)
   - ContentResultOut: typed open/preview/download response (D-02, D-18, T-13-14)
   - MutationResultOut: typed kind/reason mutation response (D-05..11)
+
+Phase 14 additions:
+  - CacheStatusOut: aggregate cache usage + settings response (T-14-02, T-14-08)
+  - CacheSettingsUpdateRequest: PATCH body for updating analysis settings/cache limit
 """
 from __future__ import annotations
 
@@ -202,3 +206,52 @@ class MoveItemRequest(BaseModel):
     destination_parent_ref: str
     destination_connection_id: Optional[str] = None
     etag: Optional[str] = None
+
+
+# ── Phase 14 cache schemas ─────────────────────────────────────────────────────
+
+class CacheStatusOut(BaseModel):
+    """Aggregate cache usage and user analysis settings.
+
+    T-14-02: object_key, credentials_enc, and raw provider URLs are absent by
+    design.  This schema is a strict allowlist — no internal MinIO keys or
+    credentials can leak through it.
+
+    entry_count:              Number of active (non-evicted) cache entries.
+    total_bytes:              Sum of size_bytes across active entries.
+    cache_limit_bytes:        User's preferred cache byte ceiling.
+    tier_cap_bytes:           Maximum allowed cache limit for this tier.
+    analysis_progress_detail: "simple" | "detailed" — default "simple".
+    analysis_failure_behavior:"pause_batch" | "continue_item" — default "pause_batch".
+    """
+
+    entry_count: int = 0
+    total_bytes: int = 0
+    cache_limit_bytes: int
+    tier_cap_bytes: int
+    analysis_progress_detail: str
+    analysis_failure_behavior: str
+
+
+class CacheSettingsUpdateRequest(BaseModel):
+    """PATCH body for updating analysis preferences and cache limit.
+
+    Only provided (non-None) fields are applied.  Enum validation and bounds
+    checking are performed in the service layer.
+
+    Mass-assignment prevention: only the three fields below are accepted.
+    """
+
+    analysis_progress_detail: Optional[str] = Field(
+        default=None,
+        description="Progress label verbosity: 'simple' or 'detailed'",
+    )
+    analysis_failure_behavior: Optional[str] = Field(
+        default=None,
+        description="Batch failure mode: 'pause_batch' or 'continue_item'",
+    )
+    cloud_cache_limit_bytes: Optional[int] = Field(
+        default=None,
+        ge=1,
+        description="Preferred byte ceiling for the local byte cache",
+    )