Repair stale stored query keys

[sdairs]

Summary

• add explicit cloud service query --repair-query-key replacement for one stored service credential
• turn stored-key Query API 401/403 responses into actionable, non-mutating repair guidance
• require exact saved organization, management key, endpoint, and binding ownership before repair
• replace only the owned endpoint key UUID while preserving other endpoint keys, roles, origins, project API credentials, and service credentials
• retain the inherited provisioning lock, atomic credential write, rollback on persistence failure, and newly provisioned endpoint readiness retry
• refuse legacy or missing records instead of guessing or silently provisioning

Tests

• cargo test -p clickhousectl
• cargo test -p clickhousectl --test cli_request_shape_test service_query_repair_replaces_only_the_exact_owned_key_and_binding -- --exact
• cargo test -p clickhousectl cloud::services::tests::parses_service_query
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Subprocess coverage pins stored-key 401 and 403 guidance with no writes, exact binding replacement when the old management key is already absent, unrelated credential preservation, and safe legacy-record refusal.

Stack

This is the child of issue-453-query-endpoint-readiness (PR #504) in gh-stack #505. It targets the parent branch; PR #504 should merge first.

Closes #454

_{Stack created with GitHub Stacks CLI • Give Feedback}

[sdairs]

This is over-engineered. The ability to create a key and associated it to a QE is already possible. This should simply be described in the output when it occurs, baking the functionality into another flag is uncessary.

[sdairs]

Addressed in 6cc7dc3: removed the dedicated --repair-query-key flag and rotation implementation. Stored-key 401/403 handling remains non-mutating and now explains how to create a key and associate its key.id through the existing query-endpoint get/create commands, including the full-configuration replacement warning. Existing automatic first-use provisioning and readiness behavior is unchanged.

Verified with:

• cargo test -p clickhousectl cloud::services::tests::service_query_help_describes_input_source_conflict -- --exact
• cargo test -p clickhousectl --test cli_request_shape_test stale_stored_query_key_guidance_uses_existing_key_and_endpoint_commands -- --exact
• cargo fmt --all --check
• cargo check -p clickhousectl
• cargo clippy -p clickhousectl --all-targets -- -D warnings

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e6095c. Configure here.}

[iskakaushik]

LGTM

[sdairs]

Superseded by #538 in stack #563.