Delete auto-provisioned query keys with services

[sdairs]

Closes #332

Summary

• Persist the management API key UUID alongside per-service Query API credentials.
• Delete only that exact stored key before deleting the service, with idempotent 404 handling and retry-safe cleanup failures.
• Keep legacy credential records readable and avoid unsafe name-based key deletion.

Tests

• cargo fmt --all --check
• cargo test -p clickhousectl -p clickhouse-cloud-api
• cargo clippy -p clickhousectl -p clickhouse-cloud-api --all-targets -- -D warnings

[Copilot]

Pull request overview

This PR improves clickhousectl cloud service delete by ensuring auto-provisioned per-service Query API keys are cleaned up in ClickHouse Cloud (when the exact management key UUID is known), preventing orphaned keys while keeping legacy credential records usable.

Changes:

• Persist the management API key UUID (api_key_id) alongside per-service Query API credentials in .clickhouse/credentials.json.
• On cloud service delete, delete the stored Query API key (by exact UUID, with 404 treated as idempotent) before deleting the service, and keep cleanup retry-safe on failure.
• Add request-shape coverage to verify delete ordering and idempotent behavior; update README documentation accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents that per-service query credentials now include the management API key ID, and explains safe cleanup behavior during service deletion.
crates/clickhousectl/tests/cli_request_shape_test.rs	Adds wiremock-based tests asserting key deletion happens before service deletion and that 404s are handled idempotently.
crates/clickhousectl/src/cloud/service_query.rs	Stores the management API key UUID into the persisted ServiceQueryKey record when auto-provisioning query access.
crates/clickhousectl/src/cloud/credentials.rs	Extends ServiceQueryKey with optional api_key_id while preserving backward-compatible deserialization/serialization.
crates/clickhousectl/src/cloud/commands.rs	Implements pre-delete cleanup of the exact stored Query API key and adjusts service delete flow/output for absent resources.
crates/clickhousectl/src/cloud/client.rs	Adds *_if_exists wrappers for service/key deletes (and service get) with 404-as-None semantics for idempotency.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 30a1b77. Configure here.}