use bound params and format_str in DDL/inspector

[joe-clickhouse]

Summary

This is a re-implementation of the suggestions from #711.

• switch the system.tables lookup from f-string interpolation to SQLA bound parameters
• build the engine arguments with the existing format_str helper instead of raw f-string interpolation, and fix a missing closing ) that made the original Replicated DDL emit invalid SQL

Checklist

Delete items not relevant to your PR:

• Unit and integration tests covering the common scenarios were added
• A human-readable description of the changes was provided to include in CHANGELOG
• For significant changes, documentation in https://github.com/ClickHouse/clickhouse-docs was updated with further explanations or tutorials

[Copilot]

Pull request overview

This PR hardens the SQLAlchemy integration by removing raw string interpolation in reflection/DDL paths, using SQLAlchemy bound parameters and the project’s format_str escaping helper, and fixes invalid Replicated CREATE DATABASE DDL output.

Changes:

• Replace system.tables engine lookup string interpolation with a bound-parameter query.
• Build Replicated database engine arguments using format_str and add the missing closing ) in emitted DDL.
• Add unit tests covering CreateDatabase/DropDatabase DDL generation (including escaping).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
clickhouse_connect/cc_sqlalchemy/inspector.py	Switches system.tables lookup to a parameterized query for get_engine.
clickhouse_connect/cc_sqlalchemy/ddl/custom.py	Uses format_str for Replicated engine args and fixes missing closing ) in emitted DDL.
tests/unit_tests/test_sqlalchemy/test_create_database.py	Adds unit tests for database DDL generation and escaping.
CHANGELOG.md	Documents the Replicated DDL fix and bound-parameter/escaping changes.