Extract auth, activity, backup, and API-key CLI domains

[sdairs]

Parent: #318

Stack position: 2 of 6.

Goal

Extract the smaller cloud command surfaces as complete vertical domain slices.

Scope

• Co-locate interactive auth command definitions and dispatch with the existing auth module.
• Add an activity module owning its clap types, write classification, dispatch, handlers, client wrappers, output, and tests.
• Add a backups module owning backup and backup-configuration clap types, builders, handlers, client wrappers, output, and tests.
• Add an API-keys module owning key clap types, builders, handlers, client wrappers, output, and tests.
• Re-export moved clap types through cloud::cli so existing internal paths remain stable.

Acceptance

• ServiceCommands::BackupConfig continues to use the backup-config command type and exhaustive write classification.
• API-key cleanup helpers used by service deletion and service_query.rs remain available without duplicating logic.
• Generated API-key secret validation remains before both output branches.
• No auth, activity, backup, or key handler remains in commands.rs.
• Existing clap, builder, subprocess, and output behavior tests pass.
• Clippy, rustfmt, and workspace checking pass.

Out of scope

• Organizations, Services, ClickPipes, and Postgres behavior.
• Command, flag, JSON, or human-output changes.