feat(13-04): upgrade Google Drive scope to drive, add health/reconnect/content API helpers

- connections.py: Update Google Drive OAuth to broader `drive` scope (D-17)
  instead of `drive.file` so authorized users can operate on all existing Drive
  items, not just files created by this app. Both initiation and callback flows
  updated to keep scopes consistent.
- schemas.py: Add Phase 13 typed response schemas — ConnectionHealthOut, ReconnectOut,
  ContentResultOut, MutationResultOut, and request schemas CreateFolderRequest,
  RenameItemRequest, MoveItemRequest. All credential-free (T-13-14, CONN-03).
- api/cloud.js: Add centralized frontend helpers for getConnectionHealth,
  reconnectCloudConnection, testCloudConnection (D-12, D-13), plus authorized
  cloud content and mutation helpers: openCloudFile, previewCloudFile,
  createCloudFolder, renameCloudItem, moveCloudItem, deleteCloudItem, uploadCloudFile.

All reconnect/health/test tests pass (14/14). Security suite passes (19/19).

backend/api/cloud/connections.py

@@ -170,6 +170,9 @@ async def _oauth_authorization_url(provider: str, redirect_uri: str, state_token
     if provider == "google_drive":
         from google_auth_oauthlib.flow import Flow  # lazy import
 
+        # D-17: Phase 13 requests the full `drive` scope so authorized users can
+        # operate on all existing Drive items, not just files created by this app.
+        # Consent text must make the expanded scope explicit.
         flow = Flow.from_client_config(
             {
                 "web": {
@@ -179,7 +182,7 @@ async def _oauth_authorization_url(provider: str, redirect_uri: str, state_token
                     "token_uri": "https://oauth2.googleapis.com/token",
                 }
             },
-            scopes=["https://www.googleapis.com/auth/drive.file"],
+            scopes=["https://www.googleapis.com/auth/drive"],
             redirect_uri=redirect_uri,
         )
         authorization_url, _ = flow.authorization_url(
@@ -211,6 +214,7 @@ async def _oauth_credentials_from_code(provider: str, redirect_uri: str, code: O
     if provider == "google_drive":
         from google_auth_oauthlib.flow import Flow  # lazy import
 
+        # D-17: Broader Phase 13 drive scope (must match initiation scope above).
         flow = Flow.from_client_config(
             {
                 "web": {
@@ -220,7 +224,7 @@ async def _oauth_credentials_from_code(provider: str, redirect_uri: str, code: O
                     "token_uri": "https://oauth2.googleapis.com/token",
                 }
             },
-            scopes=["https://www.googleapis.com/auth/drive.file"],
+            scopes=["https://www.googleapis.com/auth/drive"],
             redirect_uri=redirect_uri,
         )
         await asyncio.to_thread(flow.fetch_token, code=code)