feat(12-06): connection-ID native lifecycle — always INSERT, PUT credentials, connectionsFor multi-account

- Replace _upsert_cloud_connection with _insert_cloud_connection (always inserts new UUID row)
- Add PUT /connections/{id}/credentials endpoint (owner-scoped, SSRF + health-check, password-preserve)
- SettingsCloudTab: connectionsFor() renders all same-provider connections with Add account row
- CloudCredentialModal.submit: calls updateWebDavCredentials on edit, connectWebDav on create
- utils.js: FastAPI validation arrays normalised to concise field messages (Rule 2)
- Backend tests: same-provider independence + IDOR negative test for credential update

frontend/src/api/cloud.js

@@ -73,3 +73,17 @@ export function initiateOAuth(provider) {
 export function getConnectionConfig(connectionId) {
   return request(`/api/cloud/connections/${connectionId}/config`)
 }
+
+/**
+ * Update credentials for an existing WebDAV/Nextcloud connection (owner-scoped).
+ *
+ * Only fields included are changed. Omitting password preserves the existing secret.
+ * Backend re-validates the URL and runs a health-check before committing.
+ */
+export function updateWebDavCredentials(connectionId, { serverUrl, username, password }) {
+  const body = {}
+  if (serverUrl !== undefined) body.server_url = serverUrl
+  if (username !== undefined) body.username = username
+  if (password !== undefined && password !== '') body.password = password
+  return jsonRequest(`/api/cloud/connections/${connectionId}/credentials`, 'PUT', body)
+}