Add cloud service client command

[sdairs]

Summary

• Adds cloud service client subcommand to connect to ClickHouse Cloud services via the native clickhouse-client
• Resolves service by --name (service name) or --id (service ID)
• Auto-downloads the matching ClickHouse version for the client binary, reusing existing local install logic
• --allow-mismatched-client-version flag to use the local default version instead (with a warning)
• Password resolution: --password flag > CLICKHOUSE_PASSWORD env var > interactive TTY prompt > error
• Hidden --generate-password flag that resets the service password via API and uses it (agent-friendly escape hatch)
• Mirrors local client flags: --query, --queries-file, --user, and -- passthrough args

Usage

# Connect by service name
clickhousectl cloud service client --name my-service --password secret

# Connect by service ID with a query
clickhousectl cloud service client --id abc123 -q "SELECT 1" --password secret

# Use env var for password (agent-friendly)
CLICKHOUSE_PASSWORD=secret clickhousectl cloud service client --name my-service -q "SELECT count() FROM system.tables"

# Use local client version instead of auto-downloading
clickhousectl cloud service client --name my-service --allow-mismatched-client-version

Test plan

• Verify cloud service client --help shows expected flags
• Verify --generate-password is hidden from help but accepted
• Test with a live cloud service: --name lookup, --id lookup
• Test password resolution: flag, env var, TTY prompt
• Test auto-install of matching version
• Test --allow-mismatched-client-version with a local default set
• All existing tests pass (156 unit + 2 integration)

Closes #56

🤖 Generated with Claude Code