refactor(cli): split cloud services into a module directory (#1157)

.agents/skills/add-cli-command/references/cloud.md

@@ -4,14 +4,18 @@
 its own PR (see `crates/clickhouse-cloud-api/AGENTS.md`).
 
 Everything for a command lives in its domain module, `src/cloud/<domain>.rs`: the clap definition, permissions,
-dispatch, the `CloudClient` wrapper, the request builder, the handler and the tests. Copy the pattern from
-`src/cloud/services.rs` or `src/cloud/postgres.rs`. Handlers never call `client.api()`. The one wrapper that
-returns the raw library error is `run_service_query{,_bearer}` in `services.rs`: query paths stream the
-response and classify the error themselves. Don't copy that for other endpoints.
+dispatch, the `CloudClient` wrapper, the request builder, the handler and the tests. A large domain is a
+directory, `src/cloud/<domain>/`: `PERMISSIONS`, `run()` and re-exports in `mod.rs`, clap definitions in
+`cli.rs`, `CloudClient` wrappers in `client.rs`, and one file per command family, with tests beside the code
+they test. Copy the pattern from `src/cloud/services/` or `src/cloud/postgres.rs`. Handlers never call
+`client.api()`. The one wrapper that returns the raw library error is `run_service_query{,_bearer}` in
+`services/client.rs`: query paths stream the response and classify the error themselves. Don't copy that for
+other endpoints.
 
 1. **Definition.** Add the variant and its argument struct to the domain's command enum. For a new command
    group:
-   - Create `src/cloud/<domain>.rs` and re-export its enum privately from `src/cloud/cli.rs`.
+   - Create `src/cloud/<domain>.rs` (or `src/cloud/<domain>/mod.rs`) and re-export its enum privately from
+     `src/cloud/cli.rs`.
    - Add an arm to `CloudCommands::is_write_command()` in `src/cloud/cli.rs`.
    - Add an arm to `dispatch()` in `src/cloud/mod.rs`.
    - Add the module's `PERMISSIONS` to the list in `src/cloud/permissions.rs`.

.agents/skills/cli-help-text/SKILL.md

@@ -12,7 +12,8 @@ is noise that costs the reader time and tokens.
 ## Where help lives
 
 - `#[command(about = ..., after_help = ...)]` and arg doc comments in `src/cli.rs`, `src/local/cli.rs`,
-  `src/cloud/cli.rs` and `src/cloud/<domain>.rs` (all under `crates/clickhousectl/`).
+  `src/cloud/cli.rs` and `src/cloud/<domain>.rs`, or `src/cloud/<domain>/cli.rs` for a domain split into a
+  directory (all under `crates/clickhousectl/`).
 - `const INSTALL_AFTER_HELP` in `src/local/cli.rs`.
 - `src/cloud/permissions.rs` appends API-key permission lines to every executable Cloud command, built from each
   domain's declarations. Don't write those lines by hand.

.git-blame-ignore-revs

@@ -4,3 +4,6 @@
 
 # Format entire workspace with cargo fmt
 d78a6d2aa40a70d9e1093f09ae987ca1b26e3e41
+
+# Split cloud/services into per-command-family files (#1157)
+30bd640d06f010ddbcbcf59c0a403329748e72d2

AGENTS.md

@@ -39,7 +39,7 @@ work on a branch, with an associated issue and a PR.
 - New Cloud handlers go through `CloudClient` wrapper methods co-located in each domain module, not
   `clickhouse_cloud_api::Client` directly. `src/cloud/client.rs` owns the core client, credential precedence,
   error conversion, and response unwrapping.
-- One deliberate exception to wrapper error conversion: `run_service_query{,_bearer}` in `src/cloud/services.rs`
+- One deliberate exception to wrapper error conversion: `run_service_query{,_bearer}` in `src/cloud/services/client.rs`
   return the raw library error and an unread `reqwest::Response`, because the query paths stream the body and
   classify the error themselves before `convert_query_error`. Do not copy that shape for other endpoints.
 - Cloud handlers support `--json` unless there is good reason not to. JSON is emitted automatically when `--json`
@@ -66,7 +66,9 @@ work on a branch, with an associated issue and a PR.
 
 To add or change a local or Cloud command or flag, use the `add-cli-command` skill
 (`.agents/skills/add-cli-command/SKILL.md`). Local clap definitions live in `src/local/cli.rs`. Each Cloud
-domain keeps its definitions, handlers and tests together in `src/cloud/<domain>.rs`.
+domain keeps its definitions, handlers and tests together in `src/cloud/<domain>.rs`, or `src/cloud/<domain>/` for
+large domains (clap definitions in `cli.rs`, `CloudClient` wrappers in `client.rs`, one file per command family,
+tests beside the code they test).
 
 ## Writing help text
 
@@ -78,7 +80,8 @@ flag, or any help text. It holds the help standard and its test rule.
 Test coverage is non-negotiable.
 
 - **Clap parsing** — `Cli::try_parse_from` tests next to each command definition (`src/cli.rs`, the owning
-  `src/cloud/<domain>.rs`, `src/cloud/cli.rs`, `src/local/cli.rs`). Assert flag names, types, defaults, repeatability.
+  `src/cloud/<domain>.rs` or `src/cloud/<domain>/cli.rs`, `src/cloud/cli.rs`, `src/local/cli.rs`). Assert flag
+  names, types, defaults, repeatability.
 - **Request builders** — unit tests for `build_*_request` helpers next to the owning cloud domain code, asserting on
   library request-struct fields with minimal + maximal inputs.
 - **Cloud subprocess + wiremock** — `tests/cli_request_shape_test.rs`. Spawn the real binary against a local mock

crates/clickhousectl/src/cloud/mod.rs

@@ -15,7 +15,6 @@ pub(crate) mod permissions;
 pub mod postgres;
 pub mod query_api_endpoints;
 pub mod saved_queries;
-pub mod service_query;
 pub mod services;
 mod shared;
 pub mod types;