Validate local client selectors and reject port zero

[sdairs]

Summary

• reject mixed named and direct local client selectors during clap parsing
• reject port zero while preserving host-only and port-only direct-mode defaults
• apply equivalent validation to local Postgres clients without changing pass-through arguments
• document selector behavior and cover parse-time and fake-child execution paths

Tests

• cargo test -p clickhousectl
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Closes #466

[sdairs]

Carry-over review from PR #492 (old PR for #466). This PR is strictly superior to #492 and approved on its own merits: same minimal clap mechanism, the --version+direct-mode concern (the only review-driven change #492 needed, raised by macroscope and fixed by sdairs in e3c74bc) is handled from the first commit here and covered in both orders end-to-end, README docs added per repo convention, exhaustive 10-order permutation tests, passthrough-preservation guards, and filesystem-level proof that invalid input fails before any project-state creation. No further changes required for this PR itself.

One dependency note: this PR's local postgres edge cases CI job fails (3 cases: install_rejects_latest, port_zero_rejected, unsupported_majors) — inherited from the stack base (#547 changed port-zero rejection wording to clap's 0 is not in 1..=65535 and version wording, without updating scripts/test-postgres-integration.sh). That script reconciliation belongs to #547; once it lands and the stack rebases, this job should go green here.