Create an API query endpoint for a saved ClickHouse Cloud query via serviceQueryEndpoint, then call the generated endpoint from a client

Documented steps

1. Prerequisite: save the SQL query in the service (via the SQL console), using parameter placeholders such as {year: Int32} for any runtime variables.
2. Check for an existing endpoint: GET /v1/organizations/{organizationId}/services/{serviceId}/serviceQueryEndpoint returns the current object with id, roles, openApiKeys, and allowedOrigins.
3. Create or update (upsert) with POST on the same path. Body fields: roles (array), openApiKeys (array of OpenAPI key IDs permitted to invoke it), allowedOrigins (comma-separated string of domains for browser CORS).
4. roles controls the permission level the query runs with - the console exposes read-only and admin SQL-console roles. Confirm the accepted values by GET-ing serviceQueryEndpoint on an already-configured service before scripting.
5. curl -u "$KEY_ID:$KEY_SECRET" -X POST https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/serviceQueryEndpoint -H 'Content-Type: application/json' -d '{"roles":["sql_console_read_only"],"openApiKeys":["'$OPENAPI_KEY_ID'"],"allowedOrigins":"https://myapp.example.com"}'
6. Read the response `id` - this is the query endpoint identifier used to invoke it, and it is distinct from the saved query's own id.
7. Invoke it from a client using Basic auth with an OpenAPI key/secret listed in openApiKeys. The invocation host differs from the management host: see https://clickhouse.com/docs/cloud/features/query-api-endpoints for the current run URL, request shape (GET with param_-prefixed query variables, or POST with a queryVariables object), and supported `format` values such as JSONEachRow.
8. Remove the endpoint entirely with DELETE /v1/organizations/{organizationId}/services/{serviceId}/serviceQueryEndpoint.
9. Docs: https://clickhouse.com/docs/cloud/features/query-api-endpoints and https://clickhouse.com/docs/cloud/manage/api/api-overview