Fix two bugs found by actually running the Phase 0 pipeline end-to-end

Both surfaced only by running docker compose up for real, not from review:

- ClickHouse's official image silently disables network access for the
  default user unless CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a
  genuinely non-empty value (an explicit empty password still triggers
  it). Set a dev-only password across clickhouse, clickhouse-migrate,
  ingest, and api in both docker-compose.yml files.

- rpk cluster health and rpk topic ... don't accept --brokers; health
  checks need -X admin.hosts=... (port 9644), topic commands need
  -X brokers=... (port 9092). The old script's retry loop silently
  swallowed the resulting "unknown flag" error and retried forever,
  which blocked ingest from ever starting.

Verified: agent -> ingest -> Redpanda -> ClickHouse -> api round-trip
confirmed with a real log line on a real host.

docker-compose.yml

@@ -43,6 +43,7 @@ services:
         condition: service_healthy
     environment:
       REDPANDA_BROKERS: "redpanda:9092"
+      REDPANDA_ADMIN_HOSTS: "redpanda:9644"
 
   clickhouse:
     image: clickhouse/clickhouse-server:24.8
@@ -50,6 +51,17 @@ services:
     ports:
       - "8123:8123" # HTTP interface, used by the migrate step
       - "9000:9000" # native protocol, used by ingest and api
+    environment:
+      # The official image disables *network* access entirely for the
+      # default user (even from sibling containers) unless
+      # CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a genuinely
+      # non-empty value — confirmed by testing, not just reading docs: an
+      # explicitly-empty CLICKHOUSE_PASSWORD="" still triggers the
+      # lockdown, silently returning 403 to every other container. This
+      # password isn't a real secret (mTLS between agent and ingest is
+      # the actual security boundary here) — it exists purely to satisfy
+      # this image's login gate for local/homelab use.
+      CLICKHOUSE_PASSWORD: "sentry-dev-only"
     volumes:
       - clickhouse-data:/var/lib/clickhouse
     ulimits:
@@ -73,6 +85,7 @@ services:
         condition: service_healthy
     environment:
       CLICKHOUSE_HTTP: "http://clickhouse:8123"
+      CLICKHOUSE_PASSWORD: "sentry-dev-only"
 
   ingest:
     build:
@@ -89,6 +102,7 @@ services:
     environment:
       REDPANDA_BROKERS: "redpanda:9092"
       CLICKHOUSE_ADDR: "clickhouse:9000"
+      CLICKHOUSE_PASSWORD: "sentry-dev-only"
       # TLS_*_FILE env vars are left at their defaults
       # (/etc/sentry-ingest/{server,server-key,ca}.pem) — matches where
       # the volume below mounts the generated dev certs.
@@ -107,6 +121,7 @@ services:
       - "8080:8080"
     environment:
       CLICKHOUSE_ADDR: "clickhouse:9000"
+      CLICKHOUSE_PASSWORD: "sentry-dev-only"
 
   web:
     build: