Clouds, step 2: Settings → Cloud accounts attaches GitHub, Cloudflare and Vercel tokens, sealed, each saying what it is used for, with one audit line per vendor call #1685

Split from #1146.

Done looks like:

• [ ] Starting from src/cloud/providers.ts, an admin attaches, renames, rotates and removes one token per vendor from the page; tokens are sealed and never echoed back.
• [ ] Each account says in one line what it is used for right now (from step 1's declarations) and has a "bring it home" note naming the way back.
• [ ] Every vendor call goes through mayUse and writes an audit row (account, purpose, bytes out, when); the audit page lists today's rows.
• [ ] Tests: attach/rotate/remove; a sealed token never appears in any page; an undeclared call is refused and audited as refused.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.

Replaced by #2177. The new issue says what done looks like now. It adds the last review's ask on the pull as a checkbox, and everything that waited on this issue now waits on #2177.

Closed: already done on main in 5a187edc (pull #1776).