GET /api/v1/cloud/accounts answers the forge's cloud accounts with each token's use and today's calls, never a secret, as MCP `cloud_accounts` does #8025

Intent: a forge admin's harness can see which provider tokens the forge holds and what uses them, over HTTP; today only MCP cloud_accounts (src/http/mcp/tools/cloud_accounts.ts, through cloudOverview in src/cloud/overview.ts and usesByVendor), the terminal's Cloud screen and /settings/cloud answer it.

Done looks like:

• [ ] A new src/http/api/cloud.ts registers GET /api/v1/cloud/accounts: for a forge admin it computes usesByVendor (an error there becomes an empty map, as the tool does) and answers cloudOverview(...).value exactly as the tool does; for anyone else it answers 404 not_found, as the tool hides itself.
• [ ] Like the tool, it requires a token that may write (a ro token gets 403 forbidden, "a read-only token cannot list cloud accounts"), because every vendor call is audited.
• [ ] The answer never contains a sealed token; a test seeds one and checks the JSON does not contain its text.
• [ ] src/http/api.ts: the import goes directly after the promptRoutes import and the call directly after promptRoutes(router); (other issues register elsewhere).
• [ ] src/contract/openapi/routes/getApiV1CloudAccounts.ts describes it, exported from src/contract/openapi/routes/index.ts in its alphabetical place.
• [ ] A new test/api-cloud-accounts.test.ts proves: an admin gets the same object MCP cloud_accounts returns; a member gets 404; a ro admin token gets 403; no secret leaks; the route is in the OpenAPI document. It fails without the change.

Files: src/http/api/cloud.ts, src/http/api.ts, src/contract/openapi/routes/getApiV1CloudAccounts.ts, src/contract/openapi/routes/index.ts, test/api-cloud-accounts.test.ts Risks: usesByVendor reads git; keep the call as the tool makes it so this route costs no more than the tool. Brief: a builder who knows the API.

Parked by the crew: the check stayed red through 2 automatic tries: a non-admin sees no review and cannot decide (pull #8068 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.