api: ClickHouse ACCESS_DENIED on /v1/query and pipes should be 502, not 403 #650

Area: api / query — error semantics

A ClickHouse ACCESS_DENIED (code 497) on /v1/query and on pipe execution currently returns 403 clickhouse.access_denied. On those routes the caller's permissions have already been checked by WaveHouse's own policy engine (which returns its own 403 before any SQL runs); the SQL then runs as the tenant's configured ClickHouse user. So a ClickHouse ACCESS_DENIED there means WaveHouse's database user lacks a grant — an operator misconfiguration, not the caller's fault.

Expected: on /v1/query and pipes, map ACCESS_DENIED to 502 clickhouse.misconfigured (non-retryable, logged at WARN), like the other credential failures. Keep 403 on /v1/ops/query, where the operator wrote the statement.

Related: #403, #271, and the classifier in internal/chconn (#619 / #627).