Extract the complete Services CLI domain

[sdairs]

Parent: #318

Stack position: 4 of 6. API-key and organization slices land first because Services intentionally consumes those wrappers.

Goal

Extract the complete Services command surface into one domain module while preserving its intentional cross-domain workflows.

Scope

• Move ServiceCommands, QueryEndpointCommands, and PrivateEndpointCommands, their arguments, parsing tests, and exhaustive write classification.
• Move service/instance CRUD, scaling, upgrade windows, usage, settings, Prometheus, query, query-endpoint, and private-endpoint handlers/builders/output/tests.
• Move corresponding CloudClient wrapper methods into a domain-local impl CloudClient block.
• Keep service_query.rs as the shared service/API-key/query-endpoint orchestration module.
• Re-export moved clap types through cloud::cli.

Acceptance

• Every existing service flag, default, help shape, and write classification is unchanged.
• Cross-domain organization and API-key cleanup/provisioning calls remain explicit and functional.
• Query byte-stream output and CloudError conversion remain unchanged.
• No service/query-endpoint/private-endpoint handler remains in commands.rs.
• Existing clap, builder, wiremock subprocess, query, and output behavior tests pass.
• Clippy, rustfmt, and workspace checking pass.

Out of scope

• ClickPipes extraction.
• Refactoring service_query.rs or changing service behavior.