When authenticated via OAuth (cloud auth login), `cloud service query` now
sends the user's bearer token directly to the Query API endpoint instead of
looking up or auto-provisioning a per-service Query API key — provisioning
requires write access an OAuth token doesn't have. The API-key flow is
unchanged. `--no-auto-enable` is a documented no-op under OAuth, and a 404
from the query host maps to a clear "endpoint not enabled" error pointing
at `cloud service query-endpoint create`.

Library: `run_query` is refactored onto a shared request builder and a new
`run_query_bearer` method uses the client's own bearer token (AuthMismatch
on Basic-auth clients). The Query API host is now derived per environment
from the client's base URL (`api.<domain>` → `queries.<domain>`) instead of
hard-coding the prod host; `CLICKHOUSE_CLOUD_QUERY_HOST` still overrides,
and `with_query_host` pins it programmatically (used by tests). The
`auth-provider: custom` header marks a custom Query API key, so it is only
sent on the Basic path.

Tests: wiremock request-shape coverage for both run_query variants in the
library, unit tests for query-host derivation, and CLI subprocess tests
asserting the bearer header, the absence of provisioning calls/stored keys
under OAuth, and the stored-key Basic path.

Closes #247 (code ready; blocked on server-side bearer support at the query
endpoint for live verification).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…t hosts

- derive_query_host now keeps a non-default port from the base URL
  (api.mycorp.example.com:8443 → queries.mycorp.example.com:8443), with
  unit coverage for both custom and default ports.
- Tests still referencing the dead api.clickhouse-staging.com host now use
  api.control-plane.clickhouse-staging.com (token serialization, URL
  normalization, lib_base_url). The plain-api-prefix derivation test keeps
  the old shape deliberately.
- assert_success moved to the shared helpers in cli_request_shape_test.rs
  and reused by the dotenv and shell-env-precedence tests.
- Restore trailing newline at end of client.rs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The SQL-console-style query endpoint the OAuth path uses does not wake
an idled service on its own: it answers 206 {"data":"Confirm wake
service"} and expects the query to be resent with a `wake-service:
true` header once the user confirms (this is what the SQL console does
after prompting). The CLI previously streamed that 206 body straight
to stdout as if it were the query result.

The library now maps the query host's 206 service-state protocol to
typed errors (ServiceIdle / ServiceStopped) and run_query{,_bearer}
gain a wake_service flag that sends the wake confirmation header. The
CLI retries once with the flag set after printing a notice to stderr —
matching the API-key path, which the query host wakes automatically —
and turns ServiceStopped into a hint to run `cloud service start`
(stopped services are never woken by the Query API).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>