feat(14-05): add Celery cloud analysis task with retry harness (Task 2)

- Implement tasks/cloud_analysis_tasks.py: sync Celery bridge to async processing
- Broker payload contains IDs only — credentials decrypted in worker (T-14-10)
- _TransientError and _ClassificationRetry sentinels for bounded retry (max=3)
- Auth errors are terminal (not retried); MaxRetriesExceeded writes failure status
- celery_app.py: add cloud_analysis_tasks route and import registration
- Add 6 contract tests: task registration, broker payload shape, queue routing,
  bounded retries, sentinel pattern, connection-not-found graceful drop

backend/celery_app.py

@@ -36,6 +36,7 @@ celery_app.conf.task_routes = {
     "tasks.email_tasks.*": {"queue": "email"},
     "tasks.audit_tasks.*": {"queue": "documents"},
     "tasks.cloud_tasks.*": {"queue": "documents"},
+    "tasks.cloud_analysis_tasks.*": {"queue": "documents"},
 }
 
 # Celery beat schedule:
@@ -56,6 +57,7 @@ celery_app.conf.timezone = "UTC"
 # Explicitly import task modules — autodiscover_tasks(["tasks"]) looks for
 # tasks.tasks (appends ".tasks") which doesn't exist in our structure.
 import tasks.audit_tasks  # noqa: F401, E402
+import tasks.cloud_analysis_tasks  # noqa: F401, E402
 import tasks.cloud_tasks  # noqa: F401, E402
 import tasks.document_tasks  # noqa: F401, E402
 import tasks.email_tasks  # noqa: F401, E402