cloud service query: support OAuth login without Query API key provisioning

[sdairs]

Closes #247

What

cloud service query now works when authenticated via OAuth (cloud auth login): the CLI sends the user's bearer token directly to the Query API, skipping Query API key lookup and auto-provisioning entirely (provisioning needs write access an OAuth token doesn't have). The existing API-key flow is unchanged. Requires control-plane PR ClickHouse/control-plane#34114 (deployed to staging; prod pending).

Library (clickhouse-cloud-api)

• run_query refactored onto a shared request builder; new run_query_bearer method uses the client's own bearer token (Error::AuthMismatch on Basic-auth clients). Existing run_query signature unchanged.
• The Query API host is derived per environment from the client's base URL instead of hard-coding prod: api.[control-plane.]<domain> → queries.<domain>. CLICKHOUSE_CLOUD_QUERY_HOST still overrides; with_query_host() pins it programmatically (used by tests).
• auth-provider: custom marks a custom Query API key, so it is only sent on the Basic path.

CLI

• service_query branches on is_bearer_auth(): OAuth sends the bearer token with no provisioning and writes nothing to credentials.json; --no-auto-enable is a documented no-op under OAuth.
• Fixed staging/dev hosts in KNOWN_CONFIGS: api.clickhouse-staging.com / api.clickhouse-dev.com are NXDOMAIN; the real hosts are api.control-plane.clickhouse-{staging,dev}.com (verified via live DNS). Staging/dev OAuth login could never have matched an auth config before this.
• README documents both auth modes.

Design finding (live-verified on staging)

The JWT-authenticated Query API path is SQL-console style: it authenticates the user's own identity and never consults the service's query-endpoint configuration — queries succeed against a service whose query-endpoint GET returns NOT_FOUND, and SQL permissions follow the user's console role (the backend forces readonly only for the mcp/librechat strategies). Docs and error handling reflect that; an earlier "endpoint must be enabled by an admin" error mapping was removed as based on a wrong premise.

Tests

• Library: wiremock request-shape tests for both run_query variants (auth header, body shape, headers, error mapping); unit tests for query-host derivation across prod/staging/dev; run_query_bearer added to NON_OPENAPI_CLIENT_METHODS.
• CLI: subprocess wiremock tests asserting the bearer header, zero provisioning calls and no key file written under OAuth, and the stored-key Basic path.
• Live: OAuth query verified end-to-end on staging (incl. no-endpoint case and host derivation); API-key auto-provisioning + stored-key reuse verified on prod. Prod OAuth verification pending the prod deploy of the control-plane change.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes authentication and query routing for a core cloud workflow; API signature adds wake_service to run_query, but behavior is covered by wiremock and CLI integration tests.

Overview
cloud service query now works with OAuth by sending the user's bearer token to the Query API (SQL-console style), with no per-service key provisioning or credentials.json writes. The API-key path is unchanged: stored or auto-provisioned Query API keys still use Basic auth.

In clickhouse-cloud-api, query execution is unified behind a shared builder: new run_query_bearer, run_query gains a wake_service flag, Query hosts are derived from the management API base URL (with with_query_host / env override), and HTTP 206 responses map to ServiceIdle / ServiceStopped.

The CLI retries idle services with wake-service: true after a stderr notice and fails stopped services with a service start hint. Staging/dev OAuth host mappings are corrected to api.control-plane.clickhouse-{staging,dev}.com. README documents both Query API auth modes.

^{Reviewed by Cursor Bugbot for commit ae8acad. Bugbot is set up for automated code reviews on this repo. Configure here.}