Close live API integration test coverage gap

[sdairs]

Summary

The Rust client at crates/clickhouse-cloud-api/ exposes 100 async methods. The live integration tests in tests/integration_test.rs (service CRUD) and tests/integration_postgres_test.rs (postgres CRUD) exercise 25 of them. The other 75 are mock-tested in tests/client_test.rs only, which catches request-shape regressions but not live API drift.

The mock tests + scripts/check-openapi-drift.py will tell us when the spec moves. They won't tell us when a method that compiles locally returns 4xx in production. As clickhousectl ships more cloud commands, this gap turns into runtime errors for end users.

This issue groups the work to close that gap.

Strategy

• Three test binaries, one per resource shape:
  • integration_org_test.rs (new) — org-scoped endpoints, no service provisioning.
  • integration_test.rs (extend) — endpoints needing one ClickHouse service.
  • integration_postgres_test.rs (extend) — endpoints needing one Postgres service.
• Each binary = one #[tokio::test] lifecycle with FailureRecorder accumulating non-blocking failures so a single run reports every broken endpoint, not just the first.
• Always run all three on every PR. Path-based selection deferred.
• Failure policy: NonBlocking by default; Blocking only when downstream phases depend on the step.

Scope

Bootstrap

• Add integration_org_test.rs skeleton for org-only live coverage #152 — integration_org_test.rs skeleton + secondary-user fixture

Org suite (depends on #152)

• Cover members + invitations in org integration suite #153 — members + invitations
• Cover custom org roles CRUD in org integration suite #154 — custom roles CRUD
• Cover activity log endpoints in org integration suite #155 — activity log
• Cover openapi key get/get_list/update in org integration suite #156 — openapi key full lifecycle
• Cover organization_prometheus_get + private_endpoint_config_get_list #157 — org prometheus + private endpoint config listing

Service suite (extends integration_test.rs)

• Close service-suite query endpoint coverage — GET + DELETE #158 — query endpoint GET + DELETE
• Cover instance_password_update + instance_scaling_update #159 — password update + vertical scaling
• Cover instance_private_endpoint_create + instance_private_endpoint_config_get #160 — private endpoint create + config get
• Cover service ClickHouse settings endpoints #161 — ClickHouse settings round-trip
• Cover scaling_schedule_get / replace / upsert in service integration suite #169 — scaling_schedule get / upsert / replace

Postgres suite (extends integration_postgres_test.rs)

• Cover postgres_instance_create_read_replica #162 — read replica
• Cover postgres_instance_config_post + postgres_instance_config_patch #163 — instance config POST/PATCH (blocked on models fix)

Separate

• Scope CLI↔client contract test coverage #165 — CLI↔client contract layer (scoping)

Out of scope this round

• ClickPipes, ClickStack — WIP PRs cover them (Add cloud clickpipe commands for managing ClickPipes #130, Add ClickStack cloud commands (closes #118) #144).
• BYOC — no plan to support in consuming clients.
• ClickHouse backup endpoints + restore — deferred (includes postgres_instance_restore).
• Path-based test selection — revisit if PR run time becomes a problem.
• member_delete / member accept — would kick our test fixture or are UI-only flows.

Fixtures required

• Existing second user in the test org (already present).
• New env var CLICKHOUSE_CLOUD_TEST_SECONDARY_USER_ID — that user's id.
• Invitations sent to alasdair.brown+clickhousectl_{run_id}@clickhouse.com (catch-all alias, cancelled before accept).

Today's coverage

25/100 client methods covered live. The remaining gap is enumerated across the linked child issues; closing every in-scope issue brings live coverage to 35 of the 100 methods, with the other 65 categorised under "Out of scope this round" above.