feat(clickhouse): GCS backups + clickhouse-backup engine with keyless auth

[polera]

Summary

Extends the chart's backup support in two ways:

• GCS as a native destination (backup.destination.type=gcs) — uses ClickHouse's BACKUP … TO S3() against the GCS S3-interop endpoint with HMAC credentials.
• Opt-in Altinity clickhouse-backup engine (backup.engine=clickhouse-backup) — runs as a sidecar in the server pods (it needs file access to /var/lib/clickhouse) and is triggered over its REST API by a CronJob.

The native engine remains the default; existing values are unchanged. Chart version 0.1.0 → 0.3.0.

Why the new engine

The native engine's object-store auth is HMAC-only. For GCS that means the S3-interop endpoint, which cannot use GKE Workload Identity. The clickhouse-backup engine speaks native cloud SDKs, enabling keyless auth:

Remote	Keyless mode	How
S3	EKS IRSA	s3.auth=iam + serviceAccount.annotations role-arn
GCS	GKE Workload Identity	gcs.auth=workloadIdentity + saEmail + SA annotation

Static keys are still supported (s3.auth=keys / gcs.auth=key, inline or via existingSecret).

Behavior

• Sidecar runs clickhouse-backup server (REST API on :7171, basic-auth reusing the admin credential).
• CronJob on backup.schedule calls create_remote against each shard's lead replica (full multi-shard), plus optional schema-only on the other replicas (schemaOnlyOtherReplicas). It polls /backup/status and fails the Job on error.
• Sidecar image pinned to altinity/clickhouse-backup:2.7.2-fips (overridable).
• Restore is documented (manual via the sidecar API/exec) — not automated in this PR.

Files

• values.yaml / values.schema.json — backup.engine + backup.clickhouseBackup config block.
• templates/_helpers.tpl — chbEnabled, chbSecretName, shared chbEnv.
• templates/statefulset-server.yaml — sidecar container.
• templates/service.yaml — API port on the headless service.
• templates/cronjob-backup-chb.yaml (new) — trigger CronJob.
• templates/cronjob-backup.yaml / secret-backup.yaml — guarded/branched by engine.
• README.md, Chart.yaml.

Testing

• helm lint passes.
• Native engine renders unchanged — no sidecar, no chb CronJob (regression clean).
• All five engine/auth permutations render correctly (keys vs keyless emit the right env and secret-or-none).
• Multi-shard 2×N targets the correct pod ordinals (data on leads, schema-only on others).
• Rendered manifests validated as YAML across cases.

🤖 Generated with Claude Code