Console Your Cloud card and connections

## Requirement Original requirement (epic, verbatim): "Add support for GCP and Azure with the same functionality as AWS: - Your Cloud (former Your AWS) - NodeLink may work on GCP and Azure - What else we have AWS specific Out of Scope: Jaah Hosted (still remains AWS only)" PRD R2 — "Your Cloud" in the UI (D4), verbatim: "Your AWS" becomes **"Your Cloud"** everywhere it is rendered; the provider comes from the chosen connection. - AC2.1 Add node dialog shows a card "Your Cloud" (and "<Org>'s cloud" when filing for another org); no rendered "Your AWS" string remains in the web app, the host-origin label, or the reader docs listed in §2. → verify: open Machines › Add node on dev CP and read the card; `grep -rn "Your AWS" apps/web/src apps/docs/content` returns only test fixtures being updated, i.e. nothing. - AC2.2 The card's trade-off and footer text name no single cloud (e.g. "Auto-create in your cloud account. Your cloud provider bills you.") and when a connection is picked the footer names that provider ("…in your GCP project", "…in your Azure subscription", "…in your AWS account"). Text is readable, not truncated, at desktop and phone width (`docs/standards/ui-copy-standards.md`, `docs/standards/ui-style-guide.md`). - AC2.3 The Connections list shows a Provider column; the connection dialog asks for the provider first and shows only that provider's credentials and fields (GCP: project, region/zone, VPC network/subnet, firewall; Azure: subscription, region, resource group, VNet/subnet, NSG). Blank network fields auto-resolve at save to a default the row then shows (parity with AWS "Auto — default VPC"). → verify: create one connection per provider with network fields blank; reopen it; observe concrete resolved values. - AC2.4 Only providers whose plan switch is ON for the org appear in the provider picker; a provider OFF renders nothing (no upsell), and the API refuses it with 403 "<Label> is not on your plan. Upgrade in Billing." → verify: act as a tenant with GCP off: picker lacks GCP; a direct POST of a GCP connection returns 403. - AC4.1 (UI half) With `windows_nodes_allowed` ON, the OS control offers Windows on GCP/Azure connections for machine types that run it (as for AWS, Task 8744) … With the switch OFF, Windows is not offered on any provider. - AC5.1 Products › Instance types lets the operator pick a provider and region, lists that provider's machine types with specs and current on-demand and spot $/hour from the provider's pricing source, and allows types into the provider's allow-list. A price that cannot be read shows a one-line reason, never blocks the list. → verify: browse GCP and Azure regions on dev CP; allow two types each; observe them in the Add node type picker for that provider. - AC5.2 Add node's Instance type list for a connection shows only that provider's allowed types. → verify as above. ## Scope (Architecture C3, D13) - `apps/web/src/components/addNode/AddNodeDialog.tsx` (card `:89`, trade-off `:80-82`, footer `:775`) and `addNode/api.ts:73` host-origin label: card "Your Cloud" / "<Org>'s cloud"; footer with no connection "Launches a machine in your cloud account. Your provider bills you."; with a connection "…in your {account_noun}" taken from the API, never a client-side map. - Connections list (Settings › Cloud connections) Provider column; `ConnectionDialog.tsx` (`:501-683`) provider-first, form fields rendered from `GET /api/cloud-connections/providers` `fields` (`ConnectionField` kinds text/select/multiselect/int, `lookup`, `parent`, `auto_label`) via the generic lookup endpoint; credentials filtered to the provider's `credential_type`; after save show the resolved `network` values. One generic form — no per-provider components. - Instance types page: provider + region picker over `/api/instance-types/browse` and `/allow`; per-row price reason shown as one line. - Add node type picker passes the connection's provider; OS control offers Windows only when `windows_nodes_allowed` is ON AND the allow-list row's `windows_capable` is true (from the API). - Reader docs: replace "Your AWS" in `apps/docs/content/using-jaah/nodes/add-a-node.md:40-47`, `apps/docs/content/console-reference/directory/nodes.md:154-159, 205-250`, `apps/docs/content/using-jaah/nodes/how-nodes-work.md:41-45`, `apps/docs/content/using-jaah/credentials/add-a-credential.md:39`, `apps/docs/content/tutorials/nodes-and-capacity.md:24` (also fixes the stale "choose **Cloud**" wording). Follow `apps/docs/README.md`. - Playwright e2e at desktop and phone width (`apps/web/e2e/README.md`). Credentials & reach: Unit/e2e tests | none beyond the worktree (mocked API for GCP/Azure; local stack) | **verified**: nothing external. Live dev-CP read (AC2.1, AC5.1) | `jaah/debug/main/operator-login` (operator; dev CP `app.dev.jaah.ai`) | **verified** by the Architect stage (credential_get succeeded, value not recorded). GCP/Azure live connection creation | `jaah/test/gcp`, `jaah/test/azure` | **deferred** (operator D6) — runs in "Dev oracle run". Out of scope: Do NOT touch Jaah Cloud / Jaah Hosted UI — `HostingPicker.tsx` and the Jaah Cloud card stay as they are (N1). Do NOT change the NodeGroupDialog beyond what the API refusal needs (N4). Do NOT build node-detail lifecycle actions (the lifecycle child) or NodeLink storage choices (NodeLink children). No macOS cloud launch (N8). No change to AWS behaviour beyond the wording (N7). No client-side provider maps or rules for footer nouns, fields, actions or Windows capability. Done means: - AC2.1 — verify: `grep -rn "Your AWS" apps/web/src apps/docs/content` returns nothing; e2e reads "Your Cloud" and "<Org>'s cloud"; dev CP Add node read as operator after deploy. - AC2.2 — verify: e2e asserts the no-connection footer text and, per mocked provider, "…in your AWS account" / "…in your GCP project" / "…in your Azure subscription"; Playwright screenshots at 1280px and 390px of the card and footer are attached to the PR and show full sentences wrapped, not clipped or ellipsised (strengthened from "not truncated"); no horizontal scroll at 390px. - AC2.3 — verify: e2e: provider picked first, only that provider's credentials and fields shown; save with blank network shows resolved values on reopen; Connections list has a Provider column. Live per-provider (deferred — runs in "Dev oracle run"). - AC2.4 — verify: e2e with GCP absent from `/providers`: picker lacks GCP and no upsell text renders. - AC4.1 UI — verify: e2e: Windows offered only for a `windows_capable` type with the switch ON; absent with the switch OFF, for every provider. - AC5.1/AC5.2 UI — verify: e2e: provider+region browse lists specs and prices; a row with a price reason shows one line and the list still renders; allowing a type makes it appear in Add node's picker for that provider only. - `./dc check quick` green; merge lane `./dc check full` green; Jaah Deploy succeeds.

Your Cloud card + provider footer, provider-first connections (generic GCP/Azure form, Provider column), per-cloud instance types + price reason; quick gate, 766 vitest, e2e green; #6570 merged (5a36fb84), deploy superseded. Deferred: draft #8833. Memory: used mem-17993, mem-22518.