fix(05): cloud API path param, root sentinel, webdav creds in list, upload path

cloud.py: list_connections now decrypts and surfaces server_url +
connection_username for nextcloud/webdav providers; folder route uses
{folder_id:path} to handle slashes; translates "root" sentinel to "".
nextcloud_backend.py: skip parent directory entry in PROPFIND Depth:1 results.
webdav_backend.py: add cloud_folder + original_filename params to
upload_object so files land in the user's chosen folder with their real name.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/cloud.py

@@ -639,7 +639,19 @@ async def list_connections(
         select(CloudConnection).where(CloudConnection.user_id == current_user.id)
     )
     connections = result.scalars().all()
-    return {"items": [CloudConnectionOut.model_validate(c).model_dump() for c in connections]}
+    items = []
+    master_key = settings.cloud_creds_key.encode()
+    for conn in connections:
+        d = CloudConnectionOut.model_validate(conn).model_dump()
+        if conn.provider in ("nextcloud", "webdav"):
+            try:
+                creds = decrypt_credentials(master_key, str(conn.user_id), conn.credentials_enc)
+                d["server_url"] = creds.get("server_url")
+                d["connection_username"] = creds.get("username")
+            except Exception:
+                pass
+        items.append(d)
+    return {"items": items}
 
 
 # ── GET /api/cloud/connections/{connection_id}/config ────────────────────────
@@ -741,7 +753,7 @@ async def delete_connection(
 # ── GET /api/cloud/folders/{provider}/{folder_id} ─────────────────────────────
 
 
-@router.get("/folders/{provider}/{folder_id}")
+@router.get("/folders/{provider}/{folder_id:path}")
 async def list_cloud_folders(
     provider: str,
     folder_id: str,
@@ -874,9 +886,11 @@ async def list_cloud_folders(
 
     elif provider in ("nextcloud", "webdav"):
         backend = _build_backend(provider, credentials)
+        # "root" is a frontend sentinel meaning the WebDAV root; translate to ""
+        webdav_path = "" if folder_id == "root" else folder_id
 
         async def fetch_webdav() -> list:
-            return await backend.list_folder(folder_id)
+            return await backend.list_folder(webdav_path)
 
         items = await get_cloud_folders_cached(
             str(current_user.id), provider, folder_id, fetch_webdav