Build a structured provider sync payload from local provider records.
Used by sync_providers; exposed for callers that want to inspect what
will be sent before pushing.
Mask an API key for cross-device sync. The cloud never stores the secret —
only an opaque hint (e.g. last 4 chars) so users can recognize which key
they previously used on another device.
Fetch cloud-side providers as a structured array. Returns the parsed JSON
array and optional updated_at, or None if not set. Cloud holds masked keys
only — callers must NOT trust maskedKey as a usable secret.