feat(clickhouse): add the ClickHouse destination package - #46

Mirror streams are ReplacingMergeTree tables with tombstones and _live
views; append streams are plain MergeTree. The lease, cursors and schema
bookkeeping live in KeeperMap tables, the one compare-and-swap ClickHouse
offers, so a Keeper and keeper_map_path_prefix are required. Projected
columns are DEFAULT expressions over _raw, materialized when added to an
existing table and recomputed on repair.

Wires the package into CI (a ClickHouse container with an embedded
Keeper), the Docker matrix, release-please and the READMEs.

…ckpoint races

Every mirror write is read-decide-write, and ClickHouse has no row lock
to serialize it, so two writers on one key (the tail beside a backfill,
or a poll outliving its lease) judged against the state before the
other's insert landed: a merge could drop fields, a tombstone could lose
a version tie, an append-only event could land twice. Each batch now
holds a per-stream lock in a `_locks` KeeperMap table: strict-mode
INSERT to take it, DELETE to release, conditional UPDATE to take over
one a crashed process left behind once it expires. A lock wait that
runs out is a transient error, so the engine retries rather than
quarantines.

`migrate` left a view alone whenever it had every column; a foreign
definition with every column now goes through `applyLiveView` and is
refused, or replaced under `--repair`. A checkpoint that Keeper refused
over a version race (the holder's own renewal is enough) re-reads and
retries instead of reporting a moved cursor and replaying the poll.

Also: release-please calls the publish workflow for this package, and
the test server config loses the `--` XML forbids inside a comment, which
kept CI's ClickHouse from starting.

… out-of-range offsets

The same three fixes Postgres (#49) and MySQL (#50) got. npm installs the
bin as a symlink named after the command, which the old argv check did
not recognise, so `npx workos-sync-clickhouse` imported the CLI and did
nothing. Duplicate keys in a batch are now judged by the instant each
timestamp names rather than by its text, so `01:00:00+01:00` no longer
outranks `00:30:00Z`. And the timestamp projection range-checks the
clock and the offset ahead of the best-effort parser, which read
`24:00` as the next midnight and `+00:99` as a zone where the other
destinations project NULL.

…rded columns

`redact --user` erased rows by `user_id` only. An invitation names a user
as its inviter and as the user who accepted it, so those rows, and the
archived and quarantined events carrying those payloads, kept the
subject's id and email after the command reported success. Every column
and payload field that names a user is matched now.

A column with no `_columns` record had its expected clause recorded
without a look at the table, so after a schema applied by hand from
`init --print-sql` a changed path was recorded as installed, with the
column still reading the old path. The catalog's clause now goes through
the server's own formatter, by way of a throwaway Memory table, and is
compared with the column's stored expression; a match is recorded and
anything else is drift that `--repair` rewrites.

… probe table

Checking an unrecorded column built a throwaway table, which `init` had
no business needing a `DROP TABLE` grant for. The server's formatter is
a function too: `formatQuerySingleLine` spells a clause exactly as
`system.columns.default_expression` does, so the comparison is one
query with no DDL. The README's grants gain `DROP TABLE` for the staging
tables `reconcile` has always built and dropped, and the version floor
moves to 23.11, where the function arrived.