docs(14-09): Phase 14 closeout — docs, version bump v0.3.0→v0.4.0, security evidence

- CLAUDE.md/AGENTS.md: update current-state line to v0.4.0 Phase 14 complete;
  add Phase 14 shared module map entries (cloud_cache, cloud_analysis,
  cloud_analysis_processing, cloud_analysis_tasks, analysis router, cache API);
  add Phase 14 non-negotiable rules (hydrate_and_cache_bytes single entry point,
  IDs-only broker payload, object_key/credentials_enc excluded at schema level)
- README.md: bump to v0.4.0; add Selective cloud analysis and Cloud byte cache
  features; add Analysis API table (Phase 14 endpoints)
- SECURITY.md: add Phase 14 threat register (T-14-01..T-14-15) with evidence,
  security gate results, and accepted risks
- backend/main.py: bump FastAPI version to 0.4.0
- frontend/package.json: bump version to 0.4.0
- ROADMAP.md: mark Phase 14 complete (9/9 plans), plan 14-09 checked off
- 14-VALIDATION.md: gate evidence, requirement coverage, acceptance criteria check
- 14-SECURITY.md: security evidence summary and gate checklist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -1,6 +1,6 @@
 # DocuVault
 
-**Version 0.3.0 — Alpha**
+**Version 0.4.0 — Alpha**
 
 > **Not production-ready.** DocuVault is functional for local and self-hosted use but has not been audited or hardened for public internet exposure. APIs, environment variables, and the database schema may change without notice until a stable 1.0 release is declared.
 
@@ -22,6 +22,8 @@ A self-hosted, multi-user document management platform with AI-powered topic cla
 - **Cloud file management** — upload files into cloud folders via a sequential queue with typed conflict resolution (keep-both/replace/skip/cancel-all); create folders with bounded collision-retry naming; rename items; move items within a connection; delete with trash-or-permanent disclosure
 - **Connection health and reconnect** — per-connection health badge and error diagnostics in Settings; auto-test after connect/reconnect; Reconnect and requires-reauth banners in the shared browser; no health probe on folder navigation (D-13)
 - **Authorized cloud preview** — open and preview supported binary formats (PDF/images) through DocuVault's authorized proxy; Office/Workspace formats fall back to an ownership-checked authorized download endpoint; provider credentials and raw provider URLs are never exposed
+- **Selective cloud analysis** — analyze individual files, multi-selections, folder trees, or entire connections after reviewing scope estimates; background Celery jobs download, extract, and classify cloud files without mutating the provider; per-item cancel, skip, and retry controls with aggregate and expandable queue progress
+- **Cloud byte cache** — downloaded file bytes are stored in MinIO with LRU eviction, per-user quota accounting, and ownership-scoped pinning; open/preview/download reuse cached bytes transparently; configurable cache limit, progress detail level, and failure behavior in Settings
 - **Auth** — email/password registration with HIBP breach check, optional TOTP 2FA, 8–10 backup codes, password reset by email, sign-out-all-devices
 - **Admin panel** — user CRUD, quota assignment, per-user AI provider override, AI provider system configuration, audit log viewer with CSV export
 - **Observability** — structured JSON logging via structlog, per-request correlation IDs, Loki + Promtail + Grafana stack included in Docker Compose
@@ -356,7 +358,24 @@ cd backend && pytest -m live_nextcloud tests/test_nextcloud_live.py
 
 The live suite is excluded from ordinary CI runs. It is read-only — PROPFIND metadata requests only. No bytes are downloaded and no provider mutations are made. Missing variables produce a safe skip.
 
-**Phase 13 complete (v0.3.0):** Cloud file upload, rename, move, delete, and create-folder are all implemented. See Cloud file management feature above. Phase 14 (byte download/cache for offline preview and selective analysis) remains future work.
+**Phase 13 complete (v0.3.0):** Cloud file upload, rename, move, delete, and create-folder are all implemented. See Cloud file management feature above.
+
+**Phase 14 complete (v0.4.0):** Selective cloud analysis and byte cache are implemented. See Selective cloud analysis and Cloud byte cache features above. Phase 15 (unified smart search) is next.
+
+### Analysis API (Phase 14)
+
+| Endpoint | Purpose |
+|----------|---------|
+| `POST /api/cloud/analysis/connections/{id}/estimate` | Scope estimate — file/selection/folder/connection; no bytes downloaded |
+| `POST /api/cloud/analysis/connections/{id}/jobs` | Enqueue analysis job; returns job_id |
+| `GET /api/cloud/analysis/jobs` | List jobs (optional connection_id/status filter) |
+| `GET /api/cloud/analysis/jobs/{id}` | Job status (?detail=true for per-stage counts) |
+| `POST /api/cloud/analysis/jobs/{id}/cancel` | Cancel batch |
+| `POST /api/cloud/analysis/jobs/{id}/items/{iid}/cancel` | Cancel single item |
+| `POST /api/cloud/analysis/jobs/{id}/items/{iid}/skip` | Skip queued/failed item |
+| `POST /api/cloud/analysis/jobs/{id}/items/{iid}/retry` | Retry failed item |
+| `GET /api/cloud/analysis/cache` | Aggregate cache usage and settings |
+| `PATCH /api/cloud/analysis/cache/settings` | Update cache limit, progress detail, failure behavior |
 
 ---