[sup] Parameters: forward natively server-side, else strict {name:Type} renderer + parity test

[BorisTyshkevich]

Part of #352. Native param_* are not forwarded by the proxy (verified UNKNOWN_QUERY_PARAMETER).

Preferred: forward params server-side (ACM-side ask)

Given tight ACM integration is a plus, the cleanest fix is to have /api/cluster/{id}/query accept a structured param map (and settings) and bind them natively in ClickHouse — no client-side SQL rewriting, full type parity. Raise with the ACM team first; if accepted, this issue reduces to wiring runQuery's params through the request body.

Fallback: strict client-side {name:Type} renderer

If native forwarding isn't available, render typed value placeholders {name:Type} (CH syntax) → SQL literals, typed values only, no free-form/identifier macros. Do not reuse core/param-serialize.ts (it targets the HTTP param_* channel: passes scalar strings raw, treats unknown types as opaque — not inline-SQL-safe or type-equivalent). Instead a separate strict renderTypedSqlExpression:

1. explicit allowlist of supported type ASTs (reject unknown);
2. parse compound values into structured values (never trust free-form strings);
3. quote every textual component; emit explicit casts where CH semantics need them (e.g. {x:UUID} → CAST('…' AS UUID), Date/DateTime64/Decimal/Enum/IPv4/6/large-int);
4. reuse the existing occurrence scanner's exact spans (ignores placeholders in literals/comments); replace right-to-left.

Acceptance

• Decision recorded: native forwarding vs. client renderer.
• If renderer: allowlisted types render + CAST where needed; unsupported values fail closed.
• Parity test: same query+values via native param_* (public build) vs. this path → identical results, types, and toTypeName().

[BorisTyshkevich]

If Altinity/acm#689 (server-side native param + settings forwarding) is accepted, this issue reduces to wiring runQuery params through the request body — the strict client-side renderer becomes unnecessary.