Retry newly provisioned Query API endpoints until ready

[sdairs]

Summary

• retry a newly provisioned Query API endpoint for up to 120 seconds with exponential backoff capped at 5 seconds
• retry only non-SQL 401, 403, and generic 404 readiness responses; stopped services, SQL errors, rate limits, transport failures, and 5xx responses remain terminal
• reuse the single key and endpoint upsert from the inherited locked provisioning flow
• add subprocess wiremock coverage for a 401 -> 403 -> 404 -> success sequence, asserting one key creation and one endpoint upsert

Closes #453

Tests

• cargo test -p clickhousectl (748 passed)
• cargo test -p clickhousectl --test cli_request_shape_test service_query_retries_new_endpoint_readiness_without_reprovisioning -- --exact (1 passed)
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings

No live Cloud resources or credentials were used.

Stack

This is the child of issue-451-query-provision-singleflight (PR #493). It targets that parent branch; PR #493 remains unchanged and should merge first.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f970de0. Configure here.}

[sdairs]

why is this necessary?