feat(12-02): decompose api/cloud.py into package with connection-ID browse endpoint

- Add api/cloud/ package: connections.py, browse.py, schemas.py, __init__.py
- Add GET /api/cloud/connections/{connection_id}/items (T-12-01 IDOR, T-12-03 cred-free)
- Add PATCH /api/cloud/connections/{id} for display_name_override rename
- Add display_name_override ORM field to CloudConnection model
- Add CloudResourceAdapter service layer with str/UUID coercion
- Fix UUID type compatibility: test_cloud_items.py now uses UUID(as_uuid=True)
  matching conftest — removes String(36) patch that caused type incompatibility
- Add 11 Phase 12 integration tests (IDOR, admin block, credential exclusion,
  duplicate providers, rename, malformed UUID)
- Remove deleted api/cloud.py (replaced by api/cloud/ package)

backend/tests/conftest.py

@@ -119,6 +119,7 @@ async def db_session():
 
     # UUID(as_uuid=True) renders as CHAR(32) in SQLite — already handled by
     # SQLAlchemy's built-in UUID type mapping — no patch needed.
+    _patched_columns: list = []  # kept for finally-block symmetry
 
     engine = create_async_engine(
         "sqlite+aiosqlite:///:memory:",
@@ -149,6 +150,9 @@ async def db_session():
                 del SQLiteTypeCompiler.visit_JSONB  # type: ignore
             except AttributeError:
                 pass
+        # Restore UUID column types to leave no side effects for other test files
+        for col, orig_type in _patched_columns:
+            col.type = orig_type
 
 
 @pytest_asyncio.fixture