feat(cli): add cloud saved-query commands (#1029)

[sdairs]

Closes #1029 (with #1035). Stacked on #1035 → #1028.

Adds cloud saved-query (Beta) on top of the saved-query library methods from #1028.

Commands

• list <SERVICE_ID> [--cursor C] [--limit 1..100]. --json prints {result, limit, totalCount, nextCursor}; human output is a table plus Next cursor: … when there is one.
• get <SERVICE_ID> <ID | --name NAME>
• create <SERVICE_ID> --name NAME (--sql SQL | --sql-file PATH|-) --database DB [--param KEY=VALUE]...
• update <SERVICE_ID> <ID | --name NAME> --new-name NAME (--sql | --sql-file) --database DB [--param KEY=VALUE]...
  • This is a full replace (PUT): leaving out --param resets the parameters to empty, and the update help says so.
  • --new-name follows the --new-name convention of other update commands, because --name selects the query to update.
• delete <SERVICE_ID> <ID | --name NAME>

list and get are reads; create, update and delete are writes. --database is required because the spec has no default, and defaulting it would silently reset the database on update. --name selection pages through the list and fails if no query matches or more than one does. Blank fields, oversized SQL and duplicate --param keys are usage errors, caught before any HTTP request.

Other changes

• New module: src/cloud/saved_queries.rs, wired into cli.rs and mod.rs like query-api-endpoint.
• Classifiers: both classify-*.py scripts and their fixtures map the new file (no Cloud suites, like query_api_endpoints.rs).
• README: a new "Saved queries (beta)" subsection, and saved queries added to the --name selector list.

Tests

• Unit: builder tests (minimal and maximal), usage errors, param parsing, read/write classification and clap flags.
• Wiremock (6 tests):
  • the method, path and exact body for each command, including --sql-file -
  • cursor and limit
  • --name resolution across two pages
  • a 409 on create, a 404 on get and a 403
  • OAuth writes stopping before any HTTP request

Gates

cargo fmt and both clippy configurations are clean. cargo test -p clickhousectl passes except one Docker-only local Postgres test, which fails because Docker isn't running locally. The Python classifier tests pass.

🤖 Generated with Claude Code