Fix: make ClickHouse start in production

[mpont91]

ClickHouse never comes up with docker-compose.prod.yaml. Two separate causes, both triggered by CLICKHOUSE_PASSWORD, which that file makes mandatory.

1. The IDE user aborts the init run. 001_init.sql ends with:

CREATE USER IF NOT EXISTS intellij IDENTIFIED WITH no_password;

Setting a password takes access management away from the default user, so this fails and takes the whole run with it:

Code: 497. DB::Exception: default: Not enough privileges. To execute this query,
it is necessary to have the grant CREATE USER ON *.*. (ACCESS_DENIED)
(query: CREATE USER IF NOT EXISTS intellij IDENTIFIED WITH no_password;)

No tables are created and the container exits. Local development never hits it because docker-compose.local.yaml sets no password, leaving default unrestricted.

Moved to clickhouse/dev/999_dev_user.sql, mounted only by the local compose. An unauthenticated user has no business in a production schema anyway.

2. The users.d mount collides with the entrypoint. The image writes this exact path when CLICKHOUSE_USER/CLICKHOUSE_PASSWORD are set:

cat <<EOT > /etc/clickhouse-server/users.d/default-user.xml

and the compose file mounts a read-only file over it:

/entrypoint.sh: line 131: /etc/clickhouse-server/users.d/default-user.xml: Read-only file system

Renamed to network-access.xml. Everything in users.d is loaded regardless of filename, so it merges with the generated file instead of fighting it.

Verified. Before: container exits, 0 tables. After, with a password set: container stays up, all 33 init files apply, 162 tables, no intellij user. Local behaviour unchanged.