Support interactive ClickHouse Cloud SSO login

[treysp]

Allow users to connect to ClickHouse Cloud through their existing SSO account, without managing a separate database username and password. The experience should be similar to clickhouse-client --login, which uses a browser-based OAuth device flow.

clickhouse-connect already supports access_token and token_provider. The remaining work is to provide a helper that:

• Runs the Cloud login flow.
• Exchanges the identity-provider token for a ClickHouse service JWT.
• Handles token refresh.
• Works with both sync and async clients.

This would address the original Google Workspace use case through Cloud's login flow. The existing token-provider API could serve as the integration point.

[genzgd]

Note that currently SSO authentication is not supported in ClickHouse Cloud for data access outside of the ClickHouse SQL Console. SSO is only used for the console and for managing your ClickHouse Cloud service. It won't be possible to implement SSO in clickhouse-connect until such time as more general query access is implemented in ClickHouse Cloud.

[joe-clickhouse]

Hi @treysp I'm going to update this issue to reflect what's changed since the original request.

clickhouse-connect now supports JWT authentication and token-provider callbacks. Also Cloud now has a client login flow through clickhouse-client --login.

The remaining gap is the login experience in Python. Users still have to get and refresh the tokens on their own. This request now focuses on providing that flow, including browser login, the Cloud token exchange, and refresh handling.

The original Google Workspace use case is still relevant but the broader title reflects that this should use Cloud's existing authentication flow rather than any kind of Google-specific implementation.