ClickHouse system-bucket backup needs pod restart after first credential projection #3986

What is wrong?

ClickHouse with backup.useSystemBucket: true can start before cozy-backups-creds exists. Secret refs are optional, so sidecar starts without S3 values. First BackupJob projects Secret into tenant namespace, but environment of running clickhouse-backup container is not updated and backup still does not complete until pod restart.

This bug predates #3963. Scheme fix from that PR works when Secret existed before ClickHouse pod start.

How to reproduce

1. Use tenant namespace without cozy-backups-creds.
2. Create ClickHouse with backup.enabled: true and backup.useSystemBucket: true.
3. Create BackupJob for it with backupClassName: cozy-default.
4. Secret appears, but backup does not complete. Restart ClickHouse pod and retry, projected credentials are picked up.

Expected behaviour

First backup and restore should work without manual pod restart.

Acceptance

Make sidecar pick up credentials projected after pod start, or roll and wait for ClickHouse pod after projection. Add ClickHouse e2e which starts without Secret and runs backup and restore through cozy-default.

Update docs/operations/backup-classes.md and projector comment: projected endpoint stays bare, ClickHouse chart adds https://.

Related to #2734, projected Secret lifecycle must stay compatible with long-running ClickHouse sidecar.