Add a service-scoped repair path for stale query keys

[sdairs]

Summary

• add an explicit cloud service repair-query-key <service-id> write operation with human and JSON output
• report stored-key 401/403 failures with an exact repair command without silently provisioning
• verify ownership metadata, replace only the owned endpoint binding, preserve unrelated credentials, and retain exact cleanup metadata across partial failures
• refuse legacy or incomplete records and extend service deletion to clean pending exact key IDs

Tests

• cargo build -p clickhousectl
• cargo test -p clickhousectl --no-fail-fast
• cargo clippy -p clickhousectl --all-targets -- -D warnings
• cargo fmt --all --check

Closes #454