Expose project scope in local server errors

[sdairs]

Summary

• report the canonical exact project directory for project-scoped server list, stop, and remove lookup, metadata, and state failures
• state that parent .clickhouse directories are not searched and provide fixed recovery commands for running and stopped servers
• preserve bounded structured error codes while adding an optional project field; keep project paths in command output only and out of telemetry
• retain exact-CWD behavior through child directories, nested .clickhouse state, and symlinked working directories without adding a new --project flag

Closes #477

Tests

• isolated subprocess coverage for root versus child scope, nested state, running and stopped servers, symlinked CWDs, metadata/list failures, and JSON/human output
• cargo fmt --all --check
• cargo build -p clickhousectl
• cargo check -p clickhousectl --no-default-features
• cargo test -p clickhousectl (633 unit tests plus all integration suites)
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Stack

• Position: child 9 of 9 in gh-stack #489
• Base: Make local server metadata atomic and concurrency-safe #516 (issue-472-atomic-server-metadata)
• Parent PR is unchanged and should merge first.

[macroscopeapp]

🟡 Medium src/error.rs:220

server list returns the unscoped Error::Io when reading the project .clickhouse/servers directory fails, so the error omits the canonical lookup directory, recovery guidance, and structured project field. with_project_server_scope excludes Error::Io from its wrapping match; include this variant so permission and other directory-read failures receive the same project-scoped context.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @crates/clickhousectl/src/error.rs around line 220:

`server list` returns the unscoped `Error::Io` when reading the project `.clickhouse/servers` directory fails, so the error omits the canonical lookup directory, recovery guidance, and structured `project` field. `with_project_server_scope` excludes `Error::Io` from its wrapping match; include this variant so permission and other directory-read failures receive the same project-scoped context.