fix(tiered): provision archive mappings for API logins

[decofe]

Summary

Fix the default archive query path when TIDX uses a dedicated PostgreSQL API login. Tiered bootstrap currently creates a ClickHouse FDW mapping only for the sync owner; the API login can fail with user mapping not found for user "tidx_mainnet_api", server "tidx_clickhouse" (42704).

• Resolve the effective API role from its configured pool and recreate its specific mapping during tiered bootstrap, including restarts and hot-loaded chains.
• Preserve the owner mapping and shared-login configurations. Do not create a PUBLIC mapping or grant additional schema/table privileges.
• Add a real PostgreSQL/pg_clickhouse + ClickHouse regression covering the original failure, successful archive reads after bootstrap/rebootstrap, role quoting, and permission scope. Run it as a required CI job.

Validation

• cargo check --all-targets --locked passes.
• cargo +nightly fmt --all -- --check passes.
• cargo test --lib --bins --locked passes: 438 tests.
• cargo +nightly clippy --lib --bins --test tiered_api_role_test --locked -- -D warnings passes. All-target nightly Clippy reports pre-existing assert_is_empty lints in unrelated tests; the repository's pinned-toolchain Clippy job passes in CI.
• The real archive regression passes in CI service containers (1 test passed, 0 ignored): it reproduces the owner-only mapping failure and then verifies archive reads after bootstrap/rebootstrap, shared-login compatibility, and unchanged permission scope. This sandbox has no Docker daemon, so the live-service test runs in CI.
• All six CI checks pass, including the new archive regression gate.

This is the upstream TIDX fix, separate from the explorer's native-ClickHouse workaround in tempoxyz/tempo-apps#1241. Production requires deployment/restart after merge; no production database changes have been made here.

Prompted by: @snario