Add cloud postgres subcommand tree

[sdairs]

Closes #116.

Stacked on top of #120 — merge that first.

Summary

Plumbs all 13 ClickHouse Cloud managed Postgres operations into the CLI under clickhousectl cloud postgres ...:

• CRUD: list, get, create, update, delete
• Lifecycle: restart, promote, switchover (flat subcommands, mirroring service start|stop)
• Certs: certs get [--output PATH] — raw PEM to stdout or file (mode 0600 on unix), JSON mode wraps in {"certificate": ...}
• Runtime config: config get|replace|patch — patch accepts either --set key=value (repeatable, parses values as JSON with string fallback) or --file PATH; mutually exclusive
• Password: reset-password --password VALUE | --generate
• Read replica: read-replica create <pg-id> --name …
• PITR restore: restore <pg-id> --name … --restore-target <ISO8601>

All commands support --json, --debug, --org-id (auto-resolved), and inherit the OAuth/API-key auth-precedence and bearer-write-block that the cloud tree already uses.

Design

Everything lives in a single new module crates/clickhousectl/src/cloud/postgres.rs (~1150 lines) — the PostgresCommands clap enum, 13 handler functions, internal option structs, helpers, tests, and the is_write() classifier. This is a departure from the cli.rs + commands.rs split used for Service/Org/Backup, but it keeps the already-2400-line commands.rs from growing another 600 lines of Postgres-specific helpers (parse_pg_config_overrides, render_postgres_service, JSON-file loader, PEM file writer, password generator/validator).

• cloud/cli.rs adds one CloudCommands::Postgres { command } variant plus a one-line delegation in is_write_command() → command.is_write(), keeping the exhaustive-match compiler guard intact.
• cloud/commands.rs unchanged except for bumping resolve_org_id, parse_tag, parse_tags, parse_serde_enum from private to pub(super) so postgres.rs can reuse them.
• cloud/cli.rs::parse_datetime bumped to pub(super) for --restore-target validation.
• uuid gains the v4 feature (for --generate password, which concatenates two UUIDv4s and prefixes A1 to satisfy upper+lower+digit).

UX notes

• --size accepts any string (e.g. m7i.2xlarge); server validates. Same posture as --region.
• --pg-version constrained to 18|17|16; --ha-type to none|async|sync; --provider defaults to aws.
• update --add-tag K=V / --remove-tag K merges against current tags by fetching the pg service first and diffing.

Test plan

• cargo test -p clickhousectl — 234 passing (27 new in postgres.rs, plus 14 new write-classification assertions in cli.rs::tests)
• cargo clippy -p clickhousectl --all-targets — clean
• Release build clean
• Manual smoke: cargo run -p clickhousectl -- cloud postgres list --org-id … hits the API end-to-end (returns well-formed FORBIDDEN: early access API endpoint when auth'd via OAuth — expected, since pg is beta-gated to API-key auth)
• cloud postgres --help renders the full subcommand tree with the CONTEXT FOR AGENTS block

New tests

CLI-parse (17): list/get/delete, create minimal/all-flags/rejects-missing/rejects-invalid-version, update tag-diff/no-fields, certs get stdout+output, config get, config replace requires-file, config patch with-set/with-file/rejects-set+file-together, reset-password with-password/with-generate/rejects-both, restore valid-rfc3339/rejects-invalid-datetime, read-replica create, restart+promote+switchover.

Helper unit (6): parse_pg_config_overrides numeric/string coercion, malformed rejection, last-wins on duplicates; validate_password_rules; generated_password_is_compliant; merge_tags_adds_and_removes.

Write-classification (14 assertions): extends the existing is_write_command_read_only_commands and is_write_command_destructive_commands tests with all 14 Postgres variants.

🤖 Generated with Claude Code