fix(api): remediate remaining OpenAPI drift — Postgres backups, whoami, Kafka Glue registry (#1027)

[sdairs]

Part of #1027. Stacked on #1036 (→ #1035 → #1028).

After #1028 was opened, the live spec drifted further. On the head of #1036 the drift dry run still reported 29 actionable findings. This PR fixes all of them, and the dry run now reports No actionable drift. It is library-only; the CLI exposure is in the next PR, for #1038.

Changes

• Snapshot: clickhouse_cloud_openapi.json is refreshed from the live spec, byte-identical to it. This clears the stale-snapshot findings.
• ActivityType: adds postgres_action.
• Backup encryption (private preview):
  • New BackupEncryptionConfig, a BTreeMap<String, serde_json::Value> alias. The spec defines it as an opaque additionalProperties object whose shape depends on the provider, so it is passed through verbatim.
  • New ServicePostRequest.backup_encryption_config, omitted from the JSON when unset.
  • The analyzer marks it required because it is a bare $ref. The spec's backupId text makes it conditional (required only for a backup in your own bucket, omitted otherwise), so it stays Option. A documented optionality exemption in config.rs covers this.
• Kafka schema registry is now a Confluent/Glue union (breaking for Rust callers):
  • ClickPipeKafkaSchemaRegistry is the response type and ClickPipeMutateKafkaSchemaRegistry the request type. Both are now discriminated_union! on type. The variants are ClickPipeKafkaConfluentSchemaRegistry / ClickPipeMutateKafkaConfluentSchemaRegistry and ClickPipeKafkaGlueSchemaRegistry[Response].
  • A payload with no type still parses as Confluent, as older payloads did. If such a payload carries any glue* key it goes to Unknown instead of being misread. An unrecognized type is kept as Unknown(Value).
  • The Glue schema is used in both directions, so it is split into {Name} / {Name}Response. TryFrom converts the response to the request.
  • The authentication enums are renamed to follow their new parent schemas.
  • The crate README has a migration note.
  • CLI: compile fix only. It still builds a Confluent registry, and the request on the wire is unchanged.
• Postgres backup list (beta):
  • New postgres_service_backup_get_list(org_id, postgres_id, cursor, limit), which returns Vec<PostgresBackup> with the limit/totalCount/nextCursor envelope. The (cursor, limit) signature follows saved_query_list.
  • New PostgresBackup { key, last_modified }.
• Whoami (beta):
  • New whoami_get(). It takes no organization, and its permission metadata is empty (required_permissions: &[]), because the operation inherits the spec's global basic auth with no scopes.
  • Whoami is a union on actorType: WhoamiUser (with organizations: Vec<WhoamiOrganization>) or WhoamiApiKey. An unknown, missing or ill-fitting actor goes to Unknown(Value).
  • New domain files: src/client/whoami.rs and src/models/whoami.rs.
• Metadata: the operation descriptors for both new operations are generated into meta/operations.rs, with ALL kept sorted, and BETA_OPERATIONS is regenerated.
• Classifiers: both scripts and their fixtures map the new whoami files. The Cloud classifier maps them to the organization suite.
• Crate README: updated. The root README is unchanged.

Tests

• models_test:
  • For every new response type, a missing key and an explicit null both give None.
  • Union dispatch: Confluent with no type, an explicit type, Glue, the Glue-key guard, and unknown values.
  • The exact request JSON for each registry variant, plus request strictness.
  • An opaque round-trip of the encryption config, nested data included.
  • The new enum values.
• client_test (wiremock):
  • Backup list: cursor/limit encoding (including a special-character cursor and the no-query case), the envelope fields, and a last page with nextCursor: null.
  • Whoami: the user (bearer) and API-key (basic) variants, and an unknown actor.
  • Error paths for both methods.
• model_facade_test: covers the new export paths.
• Live integration: new steps were added but not run: a Backups step in integration_postgres_test.rs, and a Whoami step in integration_org_test.rs that expects the suite's API key to resolve to WhoamiApiKey for the configured org.

Gates

• cargo fmt and library clippy (--all-targets) are clean, as are both clickhousectl clippy configurations.
• cargo check --workspace --all-features passes.
• Library and analyzer tests pass, as do the 96 Python classifier tests and cargo test -p clickhousectl.
• python3 scripts/check-openapi-drift.py --dry-run reports No actionable drift.

The first commit refreshes the snapshot before the remaining models exist, so the spec-coverage tests fail at that commit alone. They pass at the PR head.

🤖 Generated with Claude Code