Add ClickHouse client-shell manifest and usage docs

[0xmc]

Closes #127.

Adds an interactive clickhouse-client shell and its usage instructions so engineers can run ad-hoc queries against the o11y ClickHouse when operating or debugging the telemetry pipeline, without hand-rolling a client pod each time. The manifest provisions a shell pod in o11y-system that authenticates via client certs issued for the clickhouse-migrations-client CN from the o11y-system ClusterIssuer, matching the TLS-only pattern the migrations job already uses. Usage is documented in the migration module's README, covering apply, exec into the client shell, and cleanup.

The change has been sitting unmerged on chore/clickhouse-client-shell (pushed, never PR'd); this brings it into main and closes the tracking issue.

Test plan:

• kubectl apply -f ch-shell.yaml provisions the shell pod in o11y-system
• kubectl -n o11y-system exec -it ch-shell -- clickhouse-client ... connects over the secure port using the mounted client certs
• query returns data (e.g. from system tables) without a password
• kubectl delete -f ch-shell.yaml cleans up the pod