Surface overridden environment credentials

[sdairs]

Summary

• print a one-line stderr note when environment API credentials are ignored in favor of CLI flags or the project credentials file
• show complete but outranked environment credentials as configured and inactive in cloud auth status
• document the credential precedence order in cloud --help and clarify the global credential flags
• add unit and subprocess regression coverage for the notice, status output, help text, and credential actually sent on the wire

Why

Credential resolution deliberately prefers CLI flags, then .clickhouse/credentials.json, then environment credentials, then OAuth. When a credentials file existed, a user could set environment credentials for another organization and unknowingly continue operating with the file credentials. The resolved source was visible only with --debug, while normal commands gave no indication that the environment pair had been ignored.

Impact

Commands now warn on stderr without contaminating JSON stdout, and cloud auth status distinguishes an inactive environment pair from an unconfigured one. The precedence itself is unchanged.

Stack

This PR is stacked on #351 and should be reviewed as the delta from codex/issue-335-delete-force-hint.

Closes #336.

Validation

• cargo fmt --all --check
• cargo build -p clickhousectl
• cargo test -p clickhousectl
• cargo clippy -p clickhousectl --all-targets -- -D warnings

[Copilot]

Pull request overview

This PR improves credential-source transparency in clickhousectl cloud by surfacing when environment API credentials are present but outranked by higher-precedence sources, without changing the underlying precedence rules.

Changes:

• Emit a one-line stderr notice when env API credentials are configured but ignored due to CLI flag or project-credentials-file precedence.
• Enhance cloud auth status and cloud --help/flag help text to document precedence and show inactive-but-configured env credentials.
• Add unit and subprocess regression tests to verify the notice, help text, status output, and on-wire credentials behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents precedence order and the new stderr notice / auth status behavior.
crates/clickhousectl/tests/cli_request_shape_test.rs	Adds subprocess regression coverage for env-credential override notice and inactive env status.
crates/clickhousectl/src/main.rs	Implements the stderr notice and updates cloud auth status env-row status strings.
crates/clickhousectl/src/cloud/mod.rs	Re-exports EnvCredPresence for use by the CLI layer.
crates/clickhousectl/src/cloud/client.rs	Adds derives to EnvCredPresence to support comparisons/debugging/tests.
crates/clickhousectl/src/cloud/cli.rs	Clarifies --api-key/--api-secret as explicit overrides in help output.
crates/clickhousectl/src/cli.rs	Documents credential precedence in cloud --help and adds a help-text unit test.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iskakaushik]

LGTM