fix(hosting): derive the docker clickhouse url username from CLICKHOUSE_USER

The bundled ClickHouse creates only the user named by CLICKHOUSE_USER (the official image removes the built-in default user when it differs), but the webapp CLICKHOUSE_URL and RUN_REPLICATION_CLICKHOUSE_URL hardcoded 'default', so a custom CLICKHOUSE_USER left the app unable to authenticate while the healthcheck (which already honours the var) stayed green. Derive the username in both URLs from CLICKHOUSE_USER. Also document, for the Helm chart, that inline external ClickHouse credentials are now percent-encoded (store the raw value), and that existingClaim should be pinned once a bitnami volume is adopted so client-side renders stay deterministic.

Author: nicktrn

docs/self-hosting/kubernetes.mdx

@@ -334,7 +334,10 @@ redis:
   (`data-<release>-clickhouse-shard0-0`) to keep your data — auto-detection can't run there, and
   skipping this starts ClickHouse on a fresh empty volume. If that happened, your old data is
   still on the old PVC: delete the ClickHouse StatefulSet with `--cascade=orphan` (its volume
-  configuration is immutable), set `existingClaim`, and sync again.
+  configuration is immutable), set `existingClaim`, and sync again. If you render without cluster
+  access, pin `clickhouse.persistence.existingClaim` for good once the volume is adopted: a later
+  render where the lookup can't see the PVC would otherwise try to re-add `volumeClaimTemplates`,
+  which the API server rejects on an existing StatefulSet.
 </Note>
 
 <Note>
@@ -364,6 +367,13 @@ clickhouse:
     password: "my-password"
 ```
 
+<Note>
+  An inline external `username`/`password` is percent-encoded into the connection URL for you, so
+  store the **raw** value - special characters like `@ : / %` are handled automatically. If you
+  previously percent-encoded the password by hand to work around this, switch back to the raw value.
+  (Credentials from `existingSecret` are injected at runtime and are unaffected.)
+</Note>
+
 **Using existing secrets (recommended):**
 
 ```yaml

hosting/docker/webapp/docker-compose.yml

@@ -80,11 +80,11 @@ services:
       TRIGGER_BOOTSTRAP_WORKER_GROUP_NAME: bootstrap
       TRIGGER_BOOTSTRAP_WORKER_TOKEN_PATH: /home/node/shared/worker_token
       # ClickHouse configuration
-      CLICKHOUSE_URL: ${CLICKHOUSE_URL:-http://default:${CLICKHOUSE_PASSWORD}@clickhouse:8123?secure=false}
+      CLICKHOUSE_URL: ${CLICKHOUSE_URL:-http://${CLICKHOUSE_USER:-default}:${CLICKHOUSE_PASSWORD}@clickhouse:8123?secure=false}
       CLICKHOUSE_LOG_LEVEL: ${CLICKHOUSE_LOG_LEVEL:-info}
       # Run replication
       RUN_REPLICATION_ENABLED: ${RUN_REPLICATION_ENABLED:-1}
-      RUN_REPLICATION_CLICKHOUSE_URL: ${RUN_REPLICATION_CLICKHOUSE_URL:-http://default:${CLICKHOUSE_PASSWORD}@clickhouse:8123}
+      RUN_REPLICATION_CLICKHOUSE_URL: ${RUN_REPLICATION_CLICKHOUSE_URL:-http://${CLICKHOUSE_USER:-default}:${CLICKHOUSE_PASSWORD}@clickhouse:8123}
       RUN_REPLICATION_LOG_LEVEL: ${RUN_REPLICATION_LOG_LEVEL:-info}
       # Limits
       # TASK_PAYLOAD_OFFLOAD_THRESHOLD: 524288 # 512KB