Fix two bugs found by actually running the Phase 0 pipeline end-to-end

Both surfaced only by running docker compose up for real, not from review:

- ClickHouse's official image silently disables network access for the
  default user unless CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a
  genuinely non-empty value (an explicit empty password still triggers
  it). Set a dev-only password across clickhouse, clickhouse-migrate,
  ingest, and api in both docker-compose.yml files.

- rpk cluster health and rpk topic ... don't accept --brokers; health
  checks need -X admin.hosts=... (port 9644), topic commands need
  -X brokers=... (port 9092). The old script's retry loop silently
  swallowed the resulting "unknown flag" error and retried forever,
  which blocked ingest from ever starting.

Verified: agent -> ingest -> Redpanda -> ClickHouse -> api round-trip
confirmed with a real log line on a real host.

transport/README.md

@@ -15,9 +15,17 @@ both are invoked.
 
 ```sh
 docker compose up -d
-REDPANDA_BROKERS=localhost:9092 ./provision-topics.sh
+./provision-topics.sh   # defaults (localhost:9092 / localhost:9644) match this compose file
 ```
 
+Two separate addresses matter here, confirmed by actually running this
+against a live Redpanda container: `rpk cluster health` talks to the
+**Admin API** (`REDPANDA_ADMIN_HOSTS`, port 9644), while `rpk topic ...`
+talks to the **Kafka API** (`REDPANDA_BROKERS`, port 9092) — and neither
+accepts a `--brokers` flag directly, both need `-X admin.hosts=...` /
+`-X brokers=...`. Get this wrong and it doesn't error loudly: it just
+retries the health check forever without ever reporting why.
+
 ## In the full stack
 
 The root-level `docker-compose.yml` builds this directory's `Dockerfile`