GS: Failure-safe full refresh and large-result transfer

Parent: #398
Depends on: #399, #401

Design:

• docs/design/google-sheets/full-refresh.md
• docs/design/google-sheets/large-results.md
• docs/design/google-sheets/failure-recovery.md

Scope

Implement manual full refresh with streaming ClickHouse reads, canonical value conversion, hidden staging, stable-sheet publication, limits, progress, cancellation, and failure recovery.

Acceptance criteria

• The complete query result is never required in browser memory.
• Google writes use byte-bounded explicit ranges and RAW semantics.
• Existing live data remains unchanged until all query and staging work succeeds.
• Final publication preserves the managed numeric sheet ID and atomically updates state.
• Old trailing rows/columns are cleared and formatting/metadata are refreshed.
• Ambiguous publication is reconciled by generation/refresh ID before retry.
• Row, cell, byte, duration, and spreadsheet-capacity limits are enforced without truncation.
• Cancellation and closed-tab recovery leave committed data intact and clean orphan staging later.
• Successful full refresh can initialize/reset an append checkpoint when eligible.

Non-goals

Append page selection, automatic scheduling, or in-place partial replacement when staging cannot fit.

Leggi docs/design/google-sheets/full-refresh.md, docs/design/google-sheets/large-results.md e docs/design/google-sheets/failure-recovery.md, quindi esamina i prerequisiti #399 e #401. Il lavoro è completo quando sono implementati i criteri di accettazione elencati per l’aggiornamento, lo staging, la pubblicazione, i limiti, l’annullamento, il ripristino e i checkpoint, senza troncamenti né modifiche premature ai dati live sottoposti a commit.