feat(12.1-02): centralize listing freshness gate — apply_listing_and_finalize

- Add ListingResult dataclass to cloud_items.py
- Add apply_listing_and_finalize() — single shared gate for complete/incomplete semantics
- complete=True: upserts, soft-deletes unseen children, marks fresh, advances last_refreshed_at
- complete=False: upserts seen items only, never deletes unseen, preserves prior timestamp, warns
- browse.py: replace unconditional update_folder_state('fresh') with apply_listing_and_finalize
- cloud_tasks.py: replace unconditional fresh transition with apply_listing_and_finalize
- Celery task returns structured warning status on incomplete (no credentials/provider item names)
- Fix timezone naive/aware comparison in test (SQLite strips tzinfo)

backend/tests/test_cloud_items.py

@@ -730,8 +730,12 @@ async def test_incomplete_listing_retains_cached_rows_and_last_success(db_sessio
         )
     )).scalars().first()
     assert fs is not None
-    assert fs.last_refreshed_at == prior_ts, (
-        f"incomplete listing must not overwrite last_refreshed_at: {fs.last_refreshed_at} != {prior_ts}"
+    # SQLite stores naive datetimes; strip tzinfo for comparison
+    stored_ts = fs.last_refreshed_at
+    if stored_ts is not None and stored_ts.tzinfo is None:
+        stored_ts = stored_ts.replace(tzinfo=timezone.utc)
+    assert stored_ts == prior_ts, (
+        f"incomplete listing must not overwrite last_refreshed_at: {fs.last_refreshed_at!r} != {prior_ts!r}"
     )