[sup] Parameters: forward natively server-side, else strict {name:Type} renderer + parity test

Part of #352. Native param_* are not forwarded by the proxy (verified UNKNOWN_QUERY_PARAMETER).

Preferred: forward params server-side (ACM-side ask)

Given tight ACM integration is a plus, the cleanest fix is to have /api/cluster/{id}/query accept a structured param map (and settings) and bind them natively in ClickHouse — no client-side SQL rewriting, full type parity. Raise with the ACM team first; if accepted, this issue reduces to wiring runQuery's params through the request body.

Fallback: strict client-side {name:Type} renderer

If native forwarding isn't available, render typed value placeholders {name:Type} (CH syntax) → SQL literals, typed values only, no free-form/identifier macros. Do not reuse core/param-serialize.ts (it targets the HTTP param_* channel: passes scalar strings raw, treats unknown types as opaque — not inline-SQL-safe or type-equivalent). Instead a separate strict renderTypedSqlExpression:

1. explicit allowlist of supported type ASTs (reject unknown);
2. parse compound values into structured values (never trust free-form strings);
3. quote every textual component; emit explicit casts where CH semantics need them (e.g. {x:UUID} → CAST('…' AS UUID), Date/DateTime64/Decimal/Enum/IPv4/6/large-int);
4. reuse the existing occurrence scanner's exact spans (ignores placeholders in literals/comments); replace right-to-left.

Acceptance

• Decision recorded: native forwarding vs. client renderer.
• If renderer: allowlisted types render + CAST where needed; unsupported values fail closed.
• Parity test: same query+values via native param_* (public build) vs. this path → identical results, types, and toTypeName().

Comienza con runQuery y la ruta de solicitud /api/cluster/{id}/query; después revisa core/param-serialize.ts y el escáner de ocurrencias existente. Primero registra si está disponible el reenvío nativo; si no lo está, implementa el renderizador estricto especificado y verifica la lista de comprobación de aceptación, incluida la paridad de resultados, tipos y toTypeName() con el comportamiento nativo de param_*.