dbaas: clickhouse subcommands

[simisoft-exo]

exo dbaas create clickhouse <plan> <name> [flags]
  Type flags (via --help-clickhouse):
    --clickhouse-version            ClickHouse major version
    --clickhouse-ip-filter          allow incoming connections from CIDR block
    --clickhouse-fork-from          name of a service to fork from
    --clickhouse-recovery-backup-name  backup name to restore when forking
    --clickhouse-settings           settings as JSON
    --termination-protection        enable termination protection (default true)

exo dbaas show NAME [--uri]
exo dbaas update NAME [flags]
exo dbaas delete NAME [-f]

exo dbaas user list NAME
exo dbaas user show NAME USERNAME
exo dbaas user create NAME USERNAME        # clickhouse: creates role+user, prints generated password
exo dbaas user reset-credentials NAME USERNAME
exo dbaas user reveal-secrets NAME USERNAME
exo dbaas user delete NAME USERNAME [-f]

exo dbaas role list NAME
exo dbaas role delete NAME ROLE-UUID [-f]

exo dbaas acl show NAME

Checklist

(For exoscale contributors)

• Changelog updated (under Unreleased block, and add the Pull Request #number for each bit you add to the CHANGELOG.md)
• Tested against preprod

Testing

Tested local binary against preprod

AI used disclosure: implemented with Hermes Agent with Qwen 3.8 27B on local GPU.