fix(06): CR-04 add allowlist validation for default_storage_backend

Add _VALID_BACKENDS frozenset and validate body.backend before writing
to DB in PATCH /api/users/me/default-storage. Returns HTTP 422 for
any value not in the allowlist, preventing mass-assignment and logic
bypass via arbitrary string values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/cloud.py

@@ -940,6 +940,8 @@ async def list_cloud_folders(
 
 # ── PATCH /api/users/me/default-storage ──────────────────────────────────────
 
+_VALID_BACKENDS = frozenset({"minio", "google_drive", "onedrive", "nextcloud", "webdav"})
+
 
 @users_router.patch("/me/default-storage")
 @account_limiter.limit("100/minute")
@@ -951,9 +953,14 @@ async def update_default_storage(
 ) -> dict:
     """Update the current user's default storage backend.
 
-    The backend value is stored as-is (validated by the frontend dropdown).
+    The backend value is validated against the allowlist before storage.
     Returns the updated default_storage_backend value.
     """
+    if body.backend not in _VALID_BACKENDS:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Invalid backend. Valid values: {sorted(_VALID_BACKENDS)}",
+        )
     request.state.current_user = current_user
     user = await session.get(User, current_user.id)
     if user is None: