GS: Linked-sheet resource and ClickHouse binding storage

Parent: #398
Depends on: #399

Design:

• docs/design/google-sheets/resource-model.md
• docs/design/google-sheets/configuration.md
• docs/design/google-sheets/sharing-security.md

Scope

Add the versioned linked-sheet workspace resource, strict configuration parsing, configured ClickHouse binding and refresh-log services, pinned saved-query snapshots, and binding management UI.

Acceptance criteria

• Bindings have stable IDs and versioned canonical codecs.
• One saved query may own multiple bindings.
• Binding versions are appended through the current authenticated ClickHouse connection.
• Configured table identifiers are parsed and quoted strictly; no DDL or migration is attempted.
• Table conformance and privileges produce clear diagnostics.
• Editing a workspace query does not silently alter a binding.
• Updating a binding to the current query is explicit and versioned.
• Workspace export/import preserves non-secret portable metadata and requires revalidation.
• ClickHouse grants and row policies remain the only binding ACL.

Non-goals

Refresh execution, append cursor logic, application-managed ACLs, or storing credentials.

Beginne mit dem übergeordneten Issue #398 und der Abhängigkeit #399 und lies anschließend die drei Designdokumente: docs/design/google-sheets/resource-model.md, configuration.md und sharing-security.md. Verfolge die bestehenden Einstiegspunkte für workspace, query, binding und ClickHouse connection, bevor du die Änderungen an resource, services, storage und UI planst. Als abgeschlossen gilt die Aufgabe, wenn die aufgeführten Akzeptanzkriterien erfüllt sind, ohne die genannten Nichtziele zu implementieren.