Env-var credentials are silently ignored when a credentials file exists

[sdairs]

Found during 0.4.0 RC cloud-command testing (2026-07-30).

Credential precedence is CLI flags → credentials file → env vars → OAuth (documented at crates/clickhousectl/src/cloud/client.rs:135). Consequence: when a .clickhouse/credentials.json exists, CLICKHOUSE_CLOUD_API_KEY/CLICKHOUSE_CLOUD_API_SECRET are silently ignored:

$ CLICKHOUSE_CLOUD_API_KEY=badkey CLICKHOUSE_CLOUD_API_SECRET=badsecret chctl cloud service list
(succeeds — file credentials used, env never consulted)

The precedence itself is a deliberate design decision and --debug does reveal the source ([debug] auth source: credentials file (...)). But every --help says "API key (or set CLICKHOUSE_CLOUD_API_KEY)" with no mention that a credentials file wins, and auth status shows the env tier as "Not configured" even when the vars are set-but-outranked. A user pointing env vars at org B while a file for org A exists operates on the wrong org with zero feedback.

Suggestions (any subset):

• When env credentials are set but a higher-precedence source is used, print a one-line stderr notice (note: CLICKHOUSE_CLOUD_API_KEY is set but ignored; using credentials file — see --debug).
• auth status: distinguish "Not configured" from "Configured (inactive, outranked by credentials file)".
• Mention the precedence order in the top-level cloud --help.