Reword OAuth service query docs/comments to read-only

[sdairs]

Closes #262.

Once the OAuth audience returns read-only for the service query endpoints, four places that described OAuth cloud service query as following the user's console role (implying read and write) are inaccurate. This reword fixes them to state read-only:

• README.md (OAuth login note) — "your console role's permissions" → "read-only access".
• README.md ("Query API auth modes" OAuth bullet) — reframed: the read/write contrast against API-key mode collapses under a read-only audience, so the bullet now states read-only SQL access (SELECT/reads only, no INSERT/DDL/writes) and points to API key auth for writes.
• crates/clickhouse-cloud-api/src/client.rs (run_query_bearer doc comment) — "SQL permissions follow the user's console role" → "grants read-only SQL access".
• crates/clickhousectl/src/cloud/cli.rs (Query after_help "CONTEXT FOR AGENTS" block) — "permissions follow your console role" → "read-only access (SELECT only, no writes)".

Everything else in these files already states OAuth is read-only and only becomes more accurate.

Docs/comments only — no behavior change. cargo build, cargo clippy --all-targets, and cargo test -p clickhousectl all pass.

🤖 Generated with Claude Code

---

Note

Low Risk
Comment and README edits only; no code paths or authentication logic changed.

Overview
Updates documentation and comments only so OAuth cloud service query is described as read-only SQL, matching the Query API’s read-only OAuth audience (closes #262).

README.md — The OAuth login note no longer says SQL follows your console role’s permissions; it says read-only access. In Query API auth modes, the OAuth bullet no longer implies SQL-console / role-based read+write; it states read-only access (SELECT and other reads; no INSERT, DDL, or writes) and directs users to API key auth for writes.

run_query_bearer (clickhouse-cloud-api) — Doc comment reframed from “permissions follow the user's console role” to read-only SQL access.

cloud service query CLI after_help — Agent context text updated the same way (read-only, SELECT only, no writes).

No runtime or auth behavior changes.

^{Reviewed by Cursor Bugbot for commit e17b4fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[iskakaushik]

LGTM