Refactor backend and frontend cleanup paths

backend/tests/test_cloud.py

@@ -496,15 +496,8 @@ async def test_invalid_grant_sets_requires_reauth(
     assert "re-authentication" in resp.json().get("detail", "").lower() or \
            "reconnect" in resp.json().get("detail", "").lower()
 
-    # The test checks the 503 response — the DB REQUIRES_REAUTH state transition is
-    # handled by _call_cloud_op in cloud.py (which is invoked by the real backend flow).
-    # In this test we monkeypatched get_storage_backend_for_document directly, so
-    # documents.py's except CloudConnectionError block fires, returning 503.
-    # The REQUIRES_REAUTH DB state is written by _call_cloud_op, not by documents.py.
-    # For this test we verify: (1) 503 returned, and (2) the conn was not status="ACTIVE"
-    # after the call — since the monkeypatch bypasses _call_cloud_op, we re-check conn status.
-    # The 503 path in documents.py does NOT update conn.status — that is _call_cloud_op's job.
-    # We verify the HTTP contract here; the DB transition is covered by the cloud.py unit tests.
+    # This test verifies the document content endpoint's HTTP contract when the
+    # storage layer reports an invalid cloud grant.
 
 
 # ── CLOUD-06: Disconnect / credential deletion ────────────────────────────────