feat(checkers): ClickHouse health checks over the native protocol

[WeshGuillaume]

Adds a clickhouse check type, bringing the customer-facing tally from 38 to 39.

What

A native-protocol ClickHouse checker built on clickhouse-go/v2 — the binary protocol on 9000/9440, not the HTTP interface on 8123 — so the check exercises the same transport analytics clients actually use.

Config: host, port (9000, or 9440 when secure), username (defaults to ClickHouse's own default user), password (declared secret, encrypted at rest), database (defaults to default), secure, tls_verify, timeout (max 30s), query (must start with SELECT).

Execution: ping, then run the query and report its first cell. Output carries server_version, host, port, database, secure; metrics are connection_time_ms / query_time_ms / total_time_ms. Ping failure → down, deadline → timeout, client construction failure → error. Dials through an SSH bastion when the check carries a tunnelCheckUid (SupportsTunnel: true).

Why these choices

• Typed scan. The native protocol is strictly typed: SELECT 1 arrives as a UInt8, not text, so scanning into a string fails. Destinations are allocated from each column's own ScanType() and rendered via reflection, rather than assuming a string like the database/sql-based siblings can.
• username is optional. Postgres/MySQL require it; ClickHouse ships with a default user, so defaulting is more correct than forcing operators to type default.
• secure moves the default port (9000 → 9440), matching ClickHouse Cloud, which is TLS-only. tls_verify requires secure and is rejected otherwise.
• Its own dashboard module rather than joining sqlDatabaseModule: the TLS toggle shifts the default port, which the shared SQL fields have no notion of.
• Failure results keep their diagnostic output (host/port/database/tunneled) instead of collapsing to an error string. For a tunneled check, knowing the probe crossed a bastion is exactly what makes a failure actionable.

Testing

Unit tests cover FromMap type errors, Validate bounds and the tls_verify/secure pairing, GetConfig round-trip and default omission, name/slug autofill, sample validity, and the down/timeout classification against a real listener. Tunnel tests assert the verbatim host:port crosses the bastion (an RFC 2606 .invalid host proves local resolution was skipped) and that secure reaches 9440 on the wire.

Verified against a live ClickHouse 26.1.3:

Query	Result
SELECT 1	up, result 1, server_version=26.1.3
SELECT version()	up, result 26.1.3.52
SELECT count() FROM system.parts	up, result 577
bad credentials	down, code: 516 … Authentication failed

Notes for reviewers

• Style deviates from the sibling SQL checkers in three places, deliberately, and I'm happy to realign if the project prefers literal consistency: FromMap is a loop over field tables rather than the siblings' if v, ok := m["x"].(string) wall (which needs a //nolint:cyclop); resolution uses resolved*() methods on the config instead of an execParams struct; and one failure() helper replaces the duplicated handlePingError/handleQueryError pair.
• Files are split (config.go / configmap.go, checker.go / scan.go / result.go) to stay under 200 lines each.
• golangci-lint was not available on my machine, so make lint-back did not run — gofmt and go vet are clean. dash0 lint/typecheck baseline is unchanged (identical counts before and after).
• Docs updated: check-types.md, intro.md, ssh-tunnels.md, README.md, wiki/conventions/checker-config.md, wiki/architecture.md.

🤖 Generated with Claude Code

[fclairamb]

LGTM, thank you @WeshGuillaume for this contribution !