chore(13-11): bump to v0.3.0, update docs, roadmap, and Phase 13 security gate evidence

- Version bump: 0.2.6 → 0.3.0 (Phase 13 complete — full cloud mutation surface shipped)
- CLAUDE.md: update current-state, shared module map, and Phase 13 non-negotiable rules
- README.md: add cloud file management, connection health, and authorized preview features; add Phase 13 mutation API table; mark Phase 13 complete
- ROADMAP.md: mark Phase 13 11/11 plans complete
- SECURITY.md: add Phase 13 threat register (T-13-01 through T-13-34), gate evidence (766 backend + 429 frontend tests pass, bandit 0 HIGH, npm audit 0 high/critical, gitleaks 3 pre-existing)

README.md

@@ -1,6 +1,6 @@
 # DocuVault
 
-**Version 0.2.6 — Alpha**
+**Version 0.3.0 — Alpha**
 
 > **Not production-ready.** DocuVault is functional for local and self-hosted use but has not been audited or hardened for public internet exposure. APIs, environment variables, and the database schema may change without notice until a stable 1.0 release is declared.
 
@@ -19,6 +19,9 @@ A self-hosted, multi-user document management platform with AI-powered topic cla
 - **Cloud storage backends** — connect OneDrive, Google Drive, Nextcloud, or any WebDAV server as a personal storage backend; credentials encrypted with HKDF per-user keys
 - **Unified connection-root browsing** — each connected account appears as a distinct top-level root navigable by connection UUID; duplicate same-provider accounts are disambiguated automatically; local and cloud files share one row and action implementation
 - **Capability-aware actions** — unsupported cloud actions render gray with accessible explanations; temporarily unavailable actions render amber; all remain keyboard-focusable
+- **Cloud file management** — upload files into cloud folders via a sequential queue with typed conflict resolution (keep-both/replace/skip/cancel-all); create folders with bounded collision-retry naming; rename items; move items within a connection; delete with trash-or-permanent disclosure
+- **Connection health and reconnect** — per-connection health badge and error diagnostics in Settings; auto-test after connect/reconnect; Reconnect and requires-reauth banners in the shared browser; no health probe on folder navigation (D-13)
+- **Authorized cloud preview** — open and preview supported binary formats (PDF/images) through DocuVault's authorized proxy; Office/Workspace formats fall back to an ownership-checked authorized download endpoint; provider credentials and raw provider URLs are never exposed
 - **Auth** — email/password registration with HIBP breach check, optional TOTP 2FA, 8–10 backup codes, password reset by email, sign-out-all-devices
 - **Admin panel** — user CRUD, quota assignment, per-user AI provider override, AI provider system configuration, audit log viewer with CSV export
 - **Observability** — structured JSON logging via structlog, per-request correlation IDs, Loki + Promtail + Grafana stack included in Docker Compose
@@ -321,6 +324,20 @@ Each connected account is independently addressable by its connection UUID:
 | `PATCH /api/cloud/connections/{id}` | Rename connection display name |
 | `DELETE /api/cloud/connections/{id}` | Remove connection and credentials |
 
+### Cloud Mutation API (Phase 13)
+
+| Endpoint | Purpose |
+|----------|---------|
+| `POST /api/cloud/connections/{id}/test` | Explicit connection health test (never called on navigate) |
+| `POST /api/cloud/connections/{id}/reconnect` | Reconnect with credentials refresh; preserves cached metadata |
+| `GET /api/cloud/connections/{id}/open/{item_id}` | Authorized open/preview proxy — never exposes raw provider URL |
+| `GET /api/cloud/connections/{id}/download/{item_id}` | Authorized download fallback for unsupported preview formats |
+| `POST /api/cloud/connections/{id}/upload` | Upload file; returns typed result (success/conflict/offline/reauth_required) |
+| `POST /api/cloud/connections/{id}/folders` | Create folder with bounded collision-retry naming |
+| `PATCH /api/cloud/connections/{id}/items/{item_id}/rename` | Rename; stale guard stops on external change |
+| `POST /api/cloud/connections/{id}/items/{item_id}/move` | Move within same connection; descendant check rejects self-moves |
+| `DELETE /api/cloud/connections/{id}/items/{item_id}` | Delete (trash or permanent depending on provider capability) |
+
 Browsing returns durable cached rows immediately and schedules a background `refresh_cloud_folder` Celery task to reconcile provider changes. First-visit fetches are synchronous and bounded. All browse responses are credential-free — `credentials_enc` is never serialized in the response.
 
 **Freshness states:** Browse responses include `freshness.refresh_state` (`fresh` | `warning` | `refreshing` | `stale`). `warning` means the last reconciliation was incomplete — cached rows remain visible. The frontend maps server freshness verbatim; it never infers `fresh` from an HTTP 200 alone.
@@ -339,7 +356,7 @@ cd backend && pytest -m live_nextcloud tests/test_nextcloud_live.py
 
 The live suite is excluded from ordinary CI runs. It is read-only — PROPFIND metadata requests only. No bytes are downloaded and no provider mutations are made. Missing variables produce a safe skip.
 
-**Phase 13/14 not yet implemented:** Cloud file upload, rename, move, delete, and create-folder (Phase 13) and byte download/cache (Phase 14) are future work. Current browse is read-only.
+**Phase 13 complete (v0.3.0):** Cloud file upload, rename, move, delete, and create-folder are all implemented. See Cloud file management feature above. Phase 14 (byte download/cache for offline preview and selective analysis) remains future work.
 
 ---