Cloud access request negotiation: role discovery, OAuth org selection and approval flow #1131

Summary

Implements the Cloud access request workflow in clickhousectl: from an OAuth login, discover the caller-assignable roles, propose the least-privilege set for a task, and hand the proposal to a human for approval.

Scope

• Access request PKCE handshake for scoped API keys
• OAuth identity/endpoint selection and organization selection from OAuth memberships
• Typed caller-assignable role discovery in clickhouse-cloud-api (no administrative-catalog fallback)
• Validated role proposals, browser-free approval handoff, separate approval/claim deadlines, grant reporting
• Experimental feature flag gating the flow

PRs

• feat(auth): allow OAuth device login against custom API targets #1082 — feat(auth): allow OAuth device login against custom API targets (foundation)
• feat(cloud): access request negotiation — roles, OAuth org selection and approval flow #1130 — feat(cloud): access request negotiation — roles, OAuth org selection and approval flow