Keeping passwords/credentials out of the cloud

The Wifi credentials are automatically synced to the Google Cloud if you have enabled the setting "Backup to Google Drive" (Android settings).

Regarding the credentials (e.g. username and password) used by other apps there is no way to say something in general. Those apps may or may not store the required credentials in a secure way. Modern Android systems (Android 5 and newer) provide some relative secure mechanisms for using encryption keys that are maintained by Android itself. Those keys can then be used for encrypting the credentials before saving them to the flash memory. But using encryption the correct and secure way isn't easy. A lot of app developers use the easy and sloppy way and store credentials more or less in plain text.

Also the automatic backup into the cloud comes into play - if the app developer has not configured it correctly the stored credentials are backuped/synced into the Google cloud (if enabled system-wide, see first section).

Last but not least the is your question about the possibility to detect if an app sends credentials into the net. Unfortunately the only answer is: If the app developer wants to do so the app can do it. Additionally this can also be done by any development library the developer includes into the app (advertising, tracking, ...).