[sup] Best-effort cancel via /query-kill; remove streaming; export + session-script limits

Part of #352.

Cancel (best-effort)

The proxy buffers the response, so meta.queryId arrives after the query has run — reliable pre-execution cancel isn't possible with the current contract. Implement best-effort kill of a still-running (e.g. timed-out) query via /api/cluster/{id}/query-kill (actionKillProcesses) using the returned queryId+node. Label the UI honestly ("stop / kill", not a guaranteed cancel); if that's too weak, hide server-side cancel and treat the local action as "stop waiting." (A true cancel needs an ACM-side change: client-supplied query id or an early operation id.)

Streaming button

Remove the streaming/live-progress affordance (proxy buffers). Grid still renders via the adapter's fake stream (#353). No streaming/kill code in the public build.

Export & session scripts (declared capability limits)

• Export: the current path streams uncapped bytes to disk with progress + known query id — incompatible with the buffered proxy. Disable in ACM mode, or hard-limit by bytes/time (a row cap alone is insufficient — one row can be huge).
• Session scripts: CREATE TEMPORARY TABLE / cross-statement SET don't survive (each proxy call is a fresh CH session — verified). Diagnose/disable these in ACM mode.

Acceptance

• Cancel issues /query-kill for the running queryId+node; UI label matches real semantics.
• Streaming button hidden; grid renders.
• Export disabled or hard-limited; session-dependent scripts diagnosed/disabled with a clear message.

Start by tracing the ACM query path and the /api/cluster/{id}/query-kill actionKillProcesses entry point, including how the returned queryId and node reach the UI. Check the grid adapter's fake stream and ACM-mode export/session-script handling; done means the acceptance checklist is met: honest stop/kill semantics, no streaming affordance, bounded or disabled export, and clear session-script diagnosis.