Extract cloud runtime dispatch and shared helpers from main.rs

[sdairs]

Parent: #318

Stack position: 1 of 6 under #318, intended to start after the #317 stack lands.

Goal

Establish a thin cloud runtime boundary so later domain moves no longer need to edit main.rs, and remove existing backward dependencies on monolithic command/CLI modules.

Scope

• Add cloud::run and move cloud authentication, client construction, OAuth write guarding, command dispatch, and CloudError adaptation out of main.rs.
• Move Postgres dispatch into postgres::run.
• Keep agent detection and final JSON-mode resolution in main.rs; pass the resolved mode into the cloud runtime.
• Add a domain-neutral shared module for organization resolution, Serde-enum/tag parsing, and shared date/datetime clap parsers.
• Update Postgres to consume shared helpers instead of importing cloud::commands or cloud::cli internals.

Acceptance

• The top-level Cloud arm resolves JSON mode and delegates to cloud::run.
• main.rs no longer imports individual cloud domain command enums.
• Auth-required errors still exit with code 4 and other CloudError/exit-code behavior is unchanged.
• Credential precedence, debug behavior, OAuth write rejection, and agent JSON behavior are unchanged.
• postgres.rs imports neither cloud::commands nor domain-specific cloud::cli helpers.
• Focused tests, clippy, rustfmt, and workspace checking pass.

Out of scope

• Moving non-Postgres clap definitions, handlers, builders, or client wrappers into domain modules.
• Changing authentication or user-visible command behavior.