feat(cli): query Cloud Postgres over HTTP with OAuth

[sdairs]

Add cloud postgres query so users can run read-only SQL without installing psql or supplying database credentials. For example: clickhousectl cloud postgres query <id> --query 'SELECT version()'.

Supports service ID or exact name, organization selection, --query/-q, --queries-file (including -), piped stdin, and --database. Human output streams tab-separated columns; JSON and agent output preserve the endpoint's compact array stream, including names and types. API-key authentication fails before input or HTTP with OAuth guidance. Query failures never trigger retries, credential provisioning, or a native-client fallback.

Closes #1023. This PR is stacked on #1024, the separate API-library implementation; merge that first, then retarget this PR to main.

Control-plane #41025 merged on September 28. Production Postgres query support was verified live on September 29 with clickhousectl OAuth credentials. API-key access remains unsupported.

Validation:

• cargo fmt --all --check
• cargo clippy -p clickhousectl -- -D warnings
• cargo test -p clickhousectl
• cargo check -p clickhousectl --no-default-features
• cargo clippy -p clickhousectl --all-targets --no-default-features -- -D warnings
• Library/analyzer clippy and test suites; 95 Python tests
• New parser, request-builder, input and renderer tests plus 11 subprocess tests covering OAuth, request shape, SQL sources, gzip, typed failures, interrupted streams, and closed stdout

Live validation (2026-09-29, existing evaluation service; no persistent database changes):

• The repository's live_postgres_query_bearer_smoke passed with both postgres and an existing non-default database.
• All 12 CLI acceptance checks passed: ID/name selectors, explicit database, human/JSON output, inline/file/implicit and explicit stdin, final-statement script results, empty results, duplicate names, nulls, Unicode, SQL errors, rejected writes, and organization access denial.
• A separate non-default database check returned the requested database and current_user = chpg_console_readonly.
• The rollback-protected CREATE TABLE probe was rejected with permission denied for schema public (CLI sql_error, exit 1).
• Invalid Bearer credentials returned HTTP 401; querying with an unrelated organization returned HTTP 403 (auth_required, exit 4).

No implementation fixes were needed. Updated only the documentation to remove the resolved deployment caveat; formatting and diff checks passed. Draft status is retained. The broader repository Cloud integration CI gate is separate from this direct OAuth verification.