GS: Linked-sheet resource and ClickHouse binding storage

[BorisTyshkevich]

Parent: #398
Depends on: #399

Design:

• docs/design/google-sheets/resource-model.md
• docs/design/google-sheets/configuration.md
• docs/design/google-sheets/sharing-security.md

Scope

Add the versioned linked-sheet workspace resource, strict configuration parsing, configured ClickHouse binding and refresh-log services, pinned saved-query snapshots, and binding management UI.

Acceptance criteria

• Bindings have stable IDs and versioned canonical codecs.
• One saved query may own multiple bindings.
• Binding versions are appended through the current authenticated ClickHouse connection.
• Configured table identifiers are parsed and quoted strictly; no DDL or migration is attempted.
• Table conformance and privileges produce clear diagnostics.
• Editing a workspace query does not silently alter a binding.
• Updating a binding to the current query is explicit and versioned.
• Workspace export/import preserves non-secret portable metadata and requires revalidation.
• ClickHouse grants and row policies remain the only binding ACL.

Non-goals

Refresh execution, append cursor logic, application-managed ACLs, or storing credentials.