Make PostgreSQL ClickPipe TLS failures actionable

[sdairs]

Summary

• document secure PostgreSQL ClickPipe TLS defaults and the conditional --ca-certificate / --tls-host behavior in command help
• add public-trust and private-CA README examples plus networking, logical replication, publication, and privilege prerequisites
• preserve original API errors while adding narrowly matched guidance for x509 unknown-authority and hostname-mismatch failures
• keep PostgreSQL TLS bypass flags unavailable

Verification

• cargo test -p clickhousectl cloud::clickpipes::tests (44 passed)
• cargo test -p clickhousectl --test cli_request_shape_test postgres_ (26 passed)
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings
• cargo test -p clickhousectl (748 passed)
• all three added ClickHouse documentation links returned HTTP 200
• live Cloud/PostgreSQL ClickPipe creation not run because this environment has no dedicated source or Cloud integration credentials

Stack

Position: 2 of 2. Based on #484 (issue-449-postgres-clickpipe-validation); that parent remains unchanged.

Closes #446

[iskakaushik]

LGTM

[sdairs]

Superseded by #540 in stack #563.