Add separate TCP dial address for ClickHouse connections

[BorisTyshkevich]

Summary

• add optional clickhouse.connect_host configuration through YAML, JSON, CLI, and CLICKHOUSE_CONNECT_HOST
• keep clickhouse.host as the logical HTTP and TLS identity while overriding only the underlying TCP destination
• support HTTP and native TCP with and without TLS, IPv4/IPv6 address formatting, and static multicluster dial destinations
• validate malformed dial hosts during startup, reload, and direct client creation
• document the setting in the main README and Helm examples

Why

Some deployments must bypass DNS or connect through a fixed internal address without changing the logical ClickHouse hostname. Using the IP as clickhouse.host breaks HTTP routing, TLS SNI, and certificate hostname verification. This change separates those concerns while preserving existing behavior when the override is unset.

Closes #159.

Validation

• go test -short ./...
• go test -race ./pkg/config ./pkg/clickhouse ./pkg/server -short
• go test ./pkg/clickhouse -run '^TestConnectHostPlainProtocols$' -count=1 -v
• git diff --check

The integration test connects successfully to real embedded ClickHouse listeners over both HTTP and native TCP using an intentionally non-resolvable logical hostname and a reachable connect_host.