Make PostgreSQL ClickPipe TLS failures actionable

[sdairs]

Summary

• document secure PostgreSQL ClickPipe TLS defaults, conditional PEM CA use, hostname overrides, and source prerequisites in clap help and README examples
• preserve API errors while adding narrow x509 hints for unknown authorities and hostname mismatches
• pin rendered help, documentation, diagnostic matching, and subprocess error output

Tests

• cargo test -p clickhousectl postgres_
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings
• env DO_NOT_TRACK=1 target/debug/clickhousectl cloud clickpipe create postgres --help

Closes #446