Identify which API key the CLI is currently authenticated with

[sdairs]

Problem

Users commonly have multiple API keys in ClickHouse Cloud (one per project, one for CI, etc.) and can't tell from the CLI which one is currently being used. Only the key value is visible (in env vars, credentials file, or CLI flag) — not the key's name or UUID that shows up in the Cloud UI.

This surfaced while working on #115: the user couldn't remember which of several API keys was active on the CLI.

Proposed behaviour

`cloud auth status` should show, when API-key auth is active:

• The API key's name (from the UI) and UUID
• Its assigned roles

To get there we need to fetch `openapi_key_get_list` and match the active key value against the keys returned. API responses may not include the key value (they usually only return the prefix or hash) — if so, we'll need to either:

• Extract the key ID from the key string if it's a prefix-encoded format (common pattern for OpenAPI keys), OR
• Ask the server for `GET /openapi-keys/me` if such an endpoint exists, OR
• Keep a side-table in the credentials file mapping key-value → key-id + name when the user runs `cloud auth login --api-key ...`.

Spike the options first; this probably lands as two PRs (detection + display).

Why this matters

• cloud service query: auto-bootstrap query endpoint on 401 #123 (auto-bootstrap on 401) needs the current key's UUID to add it to the query endpoint.
• cloud service create: shorthand to enable the HTTP query endpoint #124 (enable-query-endpoint on service create) needs it for the default authorization.
• Generally improves `cloud auth status` usefulness.

Related

• rewrite cloud service query to use query endpoints #115