GS: Linked-sheet resource and ClickHouse binding storage

Parent: #398
Depends on: #399

Design:

• docs/design/google-sheets/resource-model.md
• docs/design/google-sheets/configuration.md
• docs/design/google-sheets/sharing-security.md

Scope

Add the versioned linked-sheet workspace resource, strict configuration parsing, configured ClickHouse binding and refresh-log services, pinned saved-query snapshots, and binding management UI.

Acceptance criteria

• Bindings have stable IDs and versioned canonical codecs.
• One saved query may own multiple bindings.
• Binding versions are appended through the current authenticated ClickHouse connection.
• Configured table identifiers are parsed and quoted strictly; no DDL or migration is attempted.
• Table conformance and privileges produce clear diagnostics.
• Editing a workspace query does not silently alter a binding.
• Updating a binding to the current query is explicit and versioned.
• Workspace export/import preserves non-secret portable metadata and requires revalidation.
• ClickHouse grants and row policies remain the only binding ACL.

Non-goals

Refresh execution, append cursor logic, application-managed ACLs, or storing credentials.

Inizia con l’issue padre #398 e la dipendenza #399, quindi leggi i tre documenti di progettazione: docs/design/google-sheets/resource-model.md, configuration.md e sharing-security.md. Traccia i punti di ingresso esistenti di workspace, query, binding e ClickHouse connection prima di pianificare le modifiche a resource, services, storage e UI. Il lavoro è completato quando i criteri di accettazione elencati sono soddisfatti senza implementare gli obiettivi esplicitamente esclusi.