perf(clickhouse): Phase 2 legacy governance — TTL cleanup, unified pool, MV, ops API

- Replace retention ALTER DELETE with MATERIALIZE TTL; use TRUNCATE for delete-all
- Remove GORM ClickHouse pool; migrate user access log reads to ChConn
- Drop query-side trim(remote_addr); enable wait_for_async_insert=1
- Add of_node_traffic_hourly MV and dashboard traffic trend fallback
- Add GET /admin/status/clickhouse operational metrics endpoint

internal/apps/admin/logs/routers.go

@@ -248,7 +248,7 @@ func enrichAccessLogsWithUsers(ctx context.Context, list []accessLogItem) {
 // @Router /api/v1/admin/logs/access [get]
 func GetAccessLogs(c *gin.Context) {
 	ctx := c.Request.Context()
-	if !config.Config.ClickHouse.Enabled || db.ChDB(ctx) == nil {
+	if !config.Config.ClickHouse.Enabled || !db.ChConnReady() {
 		response.AbortWithError(c, http.StatusBadRequest, "ClickHouse 存储服务未启用，无法检索访问日志")
 		return
 	}
@@ -348,7 +348,7 @@ type logsAnalyticsResponse struct {
 // @Router /api/v1/admin/logs/analytics [get]
 func GetLogsAnalytics(c *gin.Context) {
 	ctx := c.Request.Context()
-	if !config.Config.ClickHouse.Enabled || db.ChDB(ctx) == nil {
+	if !config.Config.ClickHouse.Enabled || !db.ChConnReady() {
 		response.AbortWithError(c, http.StatusBadRequest, "ClickHouse 存储服务未启用，无法获取分析数据")
 		return
 	}

internal/apps/admin/status/clickhouse.go

@@ -0,0 +1,40 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package status
+
+import (
+	"net/http"
+
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/Rain-kl/Wavelet/internal/config"
+	"github.com/Rain-kl/Wavelet/internal/db"
+	analyticsrepo "github.com/Rain-kl/Wavelet/internal/repository/analytics"
+	"github.com/gin-gonic/gin"
+)
+
+// GetClickHouseStatus returns ClickHouse operational metrics for administrators.
+// @Summary 获取 ClickHouse 运行指标
+// @Description 返回 ClickHouse parts、mutation、async_insert 队列等运维指标，需要管理员权限
+// @Tags admin
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=analyticsrepo.ClickHouseOperationalStats} "获取成功"
+// @Failure 400 {object} response.Any "ClickHouse 未启用"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 403 {object} response.Any "无管理员权限"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/admin/status/clickhouse [get]
+func GetClickHouseStatus(c *gin.Context) {
+	if !config.Config.ClickHouse.Enabled || !db.ChConnReady() {
+		response.AbortWithError(c, http.StatusBadRequest, "ClickHouse 存储服务未启用")
+		return
+	}
+
+	stats, err := analyticsrepo.GetClickHouseOperationalStats(c.Request.Context())
+	if err != nil {
+		response.AbortInternal(c, "获取 ClickHouse 运行指标失败")
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(stats))
+}