Create ClickHouse customer user provisioning script

Description

Create create_user.sh — a fully self-contained script that provisions a ClickHouse user for a given customer. Takes customerId and password as arguments.

Script must:

1. Create the ClickHouse user
2. Create a customer role with a ROW POLICY scoped to analytics.* using customer_id = '{customerId}'
3. Assign the role to the user
4. Grant SELECT ON analytics.*
5. Grant INSERT ON analytics.events
6. Allow connection from any host

Check the existing test-only docker/init/50-users.sql.

Note: The analytics.* wildcard RLS is safe to use here because the lookup tables have been removed in Phase 2 (#35061, #35062).

Improvement plan: https://docs.google.com/document/d/1hVfIurPqAJJ1PN1EalmvrWXnGNt5sY21MI-409lrXpU/edit?tab=t.klqavlz4cis7#heading=h.8vek9yxw

Parent epic: #35048

Acceptance Criteria

• create_user.sh created and takes customerId and password as arguments
• Script creates the ClickHouse user with the given credentials
• ROW POLICY created scoped to analytics.* filtering by customer_id = '{customerId}'
• Role created and assigned to the user
• SELECT ON analytics.* granted
• INSERT ON analytics.events granted
• Connection allowed from any host
• Existing docker/init/50-users.sql replaced by this script
• Script is idempotent — safe to re-run without errors

Additional Context

• Source task: Task 13 (User provisioning script) from the improvement plan
• Blocked by: Phase 2 completion (#35062 — lookup tables removed, analytics.* wildcard RLS is now safe)
• Related branch: issue-34849-Add-dotCMS-Analytics-Proxy-Endpoint-for-/v1/analytics/-to-dot-ca-event-manager

Start by reading the existing test-only docker/init/50-users.sql and the issue's acceptance criteria, then determine where create_user.sh should replace it. Done means the script accepts customerId and password, provisions the ClickHouse user, role, row policy, grants, and host access, and can be rerun without errors.