Cloud accounts have a terminal screen and MCP tools as well as the page: list, attach, verify, rotate, rename, remove, and today's vendor calls #2199

Replaces #2194, which was parked twice because the Settings → Cloud accounts code (#2177) was not on main yet. This one waits for #2177 to land, then builds on what is on main.

Done looks like:

• [ ] An admin-only Cloud accounts screen in src/tui lists each account with its usedFor() line, verified / last used, and today's vendor-call count. A guest or non-admin does not see it.
• [ ] The same screen attaches (verified, sealed), re-verifies, rotates, renames and removes an account through the functions the page uses. It never shows a token value.
• [ ] MCP has admin-only tools for the same actions plus today's audit rows. A non-admin call is refused.
• [ ] A rename is refused when the forge secret CLOUD_<PROVIDER>_<NAME> already exists, not only when there is a cloud_account row with that name.
• [ ] Tests for the terminal and MCP, each as admin and as non-admin, and one for the rename collision.
• [ ] The README sentence "Cloud accounts have no terminal or MCP door yet" is replaced with how to reach both.

Files: src/tui/screens (new cloud screen), src/mcp, src/cloud, README.md, test/. Risk: a token value echoed in a terminal frame or an MCP result. Test that neither one has it. Brief: scout.

Parked by the crew: the check failed ("tell the crew in the terminal > the owner's palette has the row") and the decider saw no point in another try (pull #2205 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.