A test pins verifying a cloud account from Settings: a forge admin only, and a failing provider explained in words #7028

POST /settings/cloud/verify (cloudVerify in src/web/pages/cloud.ts) has no test.

Done:

• [ ] Each case posts the form the way the page does, through readForm, with the session cookie and a same-origin Origin header. Against a stubbed provider, an admin verifies an account that works and is told so. One that answers 401 is told why in words, with no key and no raw provider body in the page.
• [ ] A non-admin and a cross-origin post are refused, and no provider call is made.

Files: test/settings-cloud-verify.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.