fix(13): CR-06 re-raise HTTPException in preview_cloud_file instead of masking as unsupported_preview

backend/api/cloud/operations.py

@@ -293,9 +293,10 @@ async def preview_cloud_file(
         conn, adapter = await _resolve_and_get_adapter(session, connection_id, current_user.id)
         file_bytes = await adapter.get_object(item_id)
     except HTTPException:
-        # Re-raise 404 from ownership check in _resolve_and_get_adapter (already done above,
-        # but keep for belt-and-suspenders)
-        return _unsupported_preview_response(connection_id, item_id, "provider_error")
+        # Re-raise 401 (credential failure) and 404 (ownership race) — never mask as
+        # unsupported_preview. The IDOR guard in Step 1 already passed, but a 401
+        # from credential decryption should surface as an auth error to the client.
+        raise
     except Exception:
         return _unsupported_preview_response(connection_id, item_id, "provider_error")