feat(13-03): extend cloud contract with mutable adapter and provider implementations

- Add MutableCloudResourceAdapter abstract class to cloud_base.py with Phase 13
  mutable-operation vocabulary (MUT_KIND_* / MUT_REASON_* constants, PreviewSupport)
- Add abstract methods: create_folder, rename, move, delete, upload_file + _normalize_error
- Update GoogleDriveBackend to implement MutableCloudResourceAdapter with Drive-scope
  methods; prefer trash() for delete (D-11); update SCOPES to drive (D-17)
- Update OneDriveBackend to implement MutableCloudResourceAdapter; use
  PublicClientApplication for refresh_token flow; Graph DELETE is always permanent (D-11)
- Update WebDAVBackend to implement MutableCloudResourceAdapter; SSRF guard via __init__
  (not per-call) for mutable methods; _validate_destination for MOVE SSRF (T-13-04)
- NextcloudBackend inherits all mutable methods from WebDAVBackend (no changes needed)
- Add build_mutable_cloud_adapter() to cloud_backend_factory.py
- All 184 tests pass (test_cloud_backends.py + test_cloud_provider_contract.py)

backend/storage/cloud_backend_factory.py

@@ -1,7 +1,7 @@
 """Factory for user-scoped cloud storage backends."""
 from __future__ import annotations
 
-from storage.cloud_base import CloudResourceAdapter
+from storage.cloud_base import CloudResourceAdapter, MutableCloudResourceAdapter
 
 
 def build_cloud_backend(provider: str, credentials: dict):
@@ -64,3 +64,23 @@ def build_cloud_resource_adapter(provider: str, credentials: dict) -> CloudResou
             f"Provider {provider!r} backend does not implement CloudResourceAdapter"
         )
     return backend
+
+
+def build_mutable_cloud_adapter(provider: str, credentials: dict) -> MutableCloudResourceAdapter:
+    """Build a MutableCloudResourceAdapter for the given provider and credentials.
+
+    Returns a provider instance that implements the Phase 13 mutable-operation
+    contract (create_folder, rename, move, delete, upload_file) in addition to
+    the read-only CloudResourceAdapter interface.
+
+    Raises:
+        ValueError: If provider is not one of the four supported cloud providers,
+            or if the provider backend does not implement MutableCloudResourceAdapter.
+    """
+    backend = build_cloud_backend(provider, credentials)
+    if not isinstance(backend, MutableCloudResourceAdapter):
+        raise ValueError(
+            f"Provider {provider!r} backend does not implement MutableCloudResourceAdapter. "
+            "All Phase 13 providers must subclass MutableCloudResourceAdapter."
+        )
+    return backend