Make --org-id a cloud-wide selector and remove legacy positional org IDs

## Validated scope and current-PR plan — 2026-09-11

This section records the QA review and the current decision to finalize existing PRs without opening new PRs. It supersedes the proposed routing/fix suggestions in the original report below; the original observations are retained. Central plan: #757.

### Disposition

Deferred from this existing-PR finalization pass. Keep the issue open; no new PR is requested now. This is not a resolution, a severity downgrade, or a waiver of release acceptance.

### Validation and corrections

Confirmed trailing --org-id is rejected after schema-discover kafka. #782 only changes org get/update selectors and backward-compatible positionals; it does not touch ClickPipe argument inheritance. Same theme is not the same defect. A new focused PR should cover every schema-discover leaf and allowed flag positions. Ordering shared help flags is cosmetic and can share general help cleanup rather than block that functional fix.

---

## Original QA report

Found in the 2026-09-11 QA sweep of the combined PR stack at [`d2c37f81`](https://github.com/ClickHouse/clickhousectl/commit/d2c37f814fff53fe68d636e34103e2d0550bf84d), top PR #823, installed release build (package version still 0.4.2). Reproduced behaviour only; no implementation included.

Severity: low-medium.

Order of the five shared flags across every screen that has them:

| order | screens |
|---|---|
| api-key, **org-id**, api-secret, json, debug | 94 |
| api-key, api-secret, **org-id**, json, debug | 25 |
| api-key, api-secret, json, **org-id**, debug | 13 |
| api-key, api-secret, json, debug, **org-id** (after 20+ command flags) | 29 — all 8 `clickpipe create `, `service create` |

Almost certainly where `#[command(flatten)]` lands in each struct's field order. Pick one canonical position (e.g. shared flags first, fixed order).

Functional variant: `cloud clickpipe schema-discover kafka --help` (and kinesis/object-storage/pubsub) shows no `--org-id`; it exists only on the parent `schema-discover` struct, so it must precede ``:

```sh
clickhousectl cloud clickpipe schema-discover "$SVC" kafka --org-id X --brokers b --topics t --format JSONEachRow
# error: unexpected argument '--org-id' found exit 2
clickhousectl cloud clickpipe schema-discover --org-id X "$SVC" kafka … # reaches the API
```

Every other multi-org command, including the sibling `clickpipe create `, accepts `--org-id` after the subcommand.

Reproduce the documented help and invocation behavior for cloud clickpipe schema-discover and the other multi-org commands. Start by locating the command definitions and shared flattened flags, then compare org-id placement and legacy positional handling across those commands. Done means --org-id works at the intended cloud-wide position, legacy positional org IDs are removed, and shared flags use one canonical order.

Written by the indexing model from the issue text.