Fix two bugs found by actually running the Phase 0 pipeline end-to-end

Both surfaced only by running docker compose up for real, not from review:

- ClickHouse's official image silently disables network access for the
  default user unless CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a
  genuinely non-empty value (an explicit empty password still triggers
  it). Set a dev-only password across clickhouse, clickhouse-migrate,
  ingest, and api in both docker-compose.yml files.

- rpk cluster health and rpk topic ... don't accept --brokers; health
  checks need -X admin.hosts=... (port 9644), topic commands need
  -X brokers=... (port 9092). The old script's retry loop silently
  swallowed the resulting "unknown flag" error and retried forever,
  which blocked ingest from ever starting.

Verified: agent -> ingest -> Redpanda -> ClickHouse -> api round-trip
confirmed with a real log line on a real host.

storage/docker-compose.yml

@@ -9,6 +9,15 @@ services:
     ports:
       - "8123:8123" # HTTP interface, used by migrate.sh
       - "9000:9000" # native protocol, used by ingest
+    environment:
+      # The official image disables *network* access entirely for the
+      # default user (this includes the published port, not just
+      # container-to-container traffic) unless CLICKHOUSE_USER or
+      # CLICKHOUSE_PASSWORD is set to a genuinely non-empty value — an
+      # explicitly-empty CLICKHOUSE_PASSWORD="" still triggers it. Not a
+      # real secret; see the root docker-compose.yml for the full
+      # explanation.
+      CLICKHOUSE_PASSWORD: "sentry-dev-only"
     volumes:
       - clickhouse-data:/var/lib/clickhouse
     ulimits: