Clouds, step 2: Settings → Cloud accounts attaches GitHub, Cloudflare and Vercel tokens, sealed, with one audit line per vendor call kept for 90 days #2177

Replaces #1685 (parked twice). Pull #1776's gate, sealed rotate/rename and escaping passed review. Its last ask: the audit table grows forever and has no index on at.

Done looks like:

• [ ] Starting from src/cloud/providers.ts, an admin attaches, renames, rotates and removes one token per vendor. Tokens are sealed and never echoed back. Admin-only pages.
• [ ] Each account says in one line what it is used for now (from cloud.json declarations) and has a "bring it home" note naming the way back.
• [ ] Every vendor call, including a hand-out to a run, goes through the gate and writes an audit row (account, purpose, bytes out, when, allowed or refused). An undeclared call never reaches the network.
• [ ] The audit table has an index on at, and rows older than 90 days are pruned on write or on the existing sweep. The audit page lists today's rows.
• [ ] Tests: attach/rotate/rename/remove; a sealed token never appears in any page; an undeclared call is refused and audited as refused; pruning drops a 91-day-old row and keeps an 89-day-old one. New test files named in GATE.

Files: src/cloud/, src/settings/, a migration, tests, scripts/gate.ts. Risk: token leakage in error messages; never interpolate the token.