A test pins rotating, renaming and removing a cloud account from Settings: a forge admin only, never echoing the key #7020

POST /settings/cloud/rotate, /rename and /remove (in src/web/pages/cloud.ts) have no test.

Done:

• [ ] Each case posts the form the way the page does, through readForm, with the session cookie and a same-origin Origin header. An admin rotates an account's key, renames the account, then removes it. Each answer says so, and the account list shows the change.
• [ ] A non-admin and a cross-origin post are refused for each of the three, and the account stays as it was.
• [ ] Neither the old key nor the new one shows in any page, flash or event.
• [ ] Renaming to an empty name, or to a name already taken, is refused with the action's words.

Files: test/settings-cloud-forms.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.