Make PostgreSQL ClickPipe TLS failures actionable

[sdairs]

Summary

• document secure PostgreSQL ClickPipe TLS defaults and the conditional --ca-certificate / --tls-host behavior in command help
• add public-trust and private-CA README examples plus networking, logical replication, publication, and privilege prerequisites
• preserve original API errors while adding narrowly matched guidance for x509 unknown-authority and hostname-mismatch failures
• keep PostgreSQL TLS bypass flags unavailable

Verification

• cargo test -p clickhousectl cloud::clickpipes::tests (44 passed)
• cargo test -p clickhousectl --test cli_request_shape_test postgres_ (26 passed)
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings
• cargo test -p clickhousectl (748 passed)
• all three added ClickHouse documentation links returned HTTP 200
• live Cloud/PostgreSQL ClickPipe creation not run because this environment has no dedicated source or Cloud integration credentials

Stack

Position: 2 of 2. Based on #484 (issue-449-postgres-clickpipe-validation); that parent remains unchanged.

Closes #446

[macroscopeapp]

🟠 High README.md:816

The PostgreSQL examples omit --publication-name, so following these instructions can make pipe creation enter the API's auto-create path and fail for users who only granted the documented schema, table, and replication privileges (or use a different publication). Add --publication-name <created-name> to both examples, or document the additional CREATE/ownership permissions required for auto-creation.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @README.md around line 816:

The PostgreSQL examples omit `--publication-name`, so following these instructions can make pipe creation enter the API's auto-create path and fail for users who only granted the documented schema, table, and replication privileges (or use a different publication). Add `--publication-name <created-name>` to both examples, or document the additional `CREATE`/ownership permissions required for auto-creation.