feat(12-06): connection-ID native lifecycle — always INSERT, PUT credentials, connectionsFor multi-account

- Replace _upsert_cloud_connection with _insert_cloud_connection (always inserts new UUID row)
- Add PUT /connections/{id}/credentials endpoint (owner-scoped, SSRF + health-check, password-preserve)
- SettingsCloudTab: connectionsFor() renders all same-provider connections with Add account row
- CloudCredentialModal.submit: calls updateWebDavCredentials on edit, connectWebDav on create
- utils.js: FastAPI validation arrays normalised to concise field messages (Rule 2)
- Backend tests: same-provider independence + IDOR negative test for credential update

frontend/src/components/cloud/CloudCredentialModal.vue

@@ -302,14 +302,18 @@ async function submit() {
   connectError.value = ''
   saving.value = true
   try {
-    const finalUrl = resolvedServerUrl.value
-    const finalPassword = password.value
-
-    // For edit mode with no new password, we still need to call the endpoint —
-    // the backend's connect_webdav upserts credentials. If password is empty on edit,
-    // the server will reject. We need to handle this: for now require password re-entry.
-    // (Future enhancement: PATCH endpoint that accepts partial updates)
-    await api.connectWebDav(props.provider.key, finalUrl, username.value, finalPassword)
+    if (props.existing && props.existing.id) {
+      // Edit existing connection — call the connection-ID update endpoint.
+      // Password is optional: omitting it preserves the current secret.
+      await api.updateWebDavCredentials(props.existing.id, {
+        serverUrl: resolvedServerUrl.value || undefined,
+        username: username.value || undefined,
+        password: password.value || undefined,
+      })
+    } else {
+      // New connection — always creates a fresh UUID row on the backend.
+      await api.connectWebDav(props.provider.key, resolvedServerUrl.value, username.value, password.value)
+    }
     emit('connected')
     emit('close')
   } catch (e) {