[BorisTyshkevich]

Summary

Adds docs/HOSTED-INSTALL.md, the operator runbook for restricted and multi-node ClickHouse installs. ASSET-DISTRIBUTION.md stays the mechanism/design reference (cross-linked, procedures not duplicated). README, DEPLOYMENT.md, ASSET-DISTRIBUTION.md, docs/deployment.html, .wiki/Deployment-and-Security.md, .wiki/Source-Map.md and CHANGELOG link to it. Also fixes a stale deployment.html statement (the container image is Caddy, not the Python runner).

Verified live on clickhouse-server:26.3.18.32 (single node, stage-grant user): SHOW GRANTS, system.clusters query, file() write/read/truncate probe, clusterAllReplicas identity probe, url() probe (incl. the real GitHub release URL, 2,126,368 bytes), binary-safe curl upload (SHA-256 identical). The clickhouse-operator spec.configuration.files convention (config.d/... key) and secret.auto were checked against the operator repo's examples/docs. Found while writing: the installer rejects the {cluster} macro (name must match [A-Za-z0-9_.-]+), so the runbook says to use the literal name from system.clusters.

PR 3 checklist

• Preflight decision table: HOSTED-INSTALL section 1 (questions, topology table, preflight SQL a-f).
• Tested least-privilege grants: section 2 as GRANT statements (mirrors tests/deploy/cfg/users.xml); versions recorded.
• End-to-end examples: section 3 (a) native, (b) HTTPS/curl, (c) Altinity Cloud, (d) operator. (c)/(d) are explicitly not tested end to end; TLS against a live server is also untested.
• Topology, scale-out, node replacement, retry: section 4.
• Enable/verify handlers, redirect URI, public config.json: section 5.
• Option B described only: section 6.

Definition of done

• 2x2 fresh/upgrade/repair byte-exact, OSS + Altinity, versions recorded: done in deploy: fix stale docs and installer URL output (#692 part 1) #693/deploy: SQL-only two-phase install with server-side fan-out and per-node verification (#692 part 2) #694 (tests/deploy/), recorded in the docs.
• Multi-shard: tested procedure (same --cluster path); fails closed.
• Grants tested; provider restrictions listed (config.d push, file(), ClickHouse Cloud File engine, which is stated but untested).
• Regression tests: in deploy: fix stale docs and installer URL output (#692 part 1) #693/deploy: SQL-only two-phase install with server-side fan-out and per-node verification (#692 part 2) #694.
• No stale statements: reconciled in the docs listed above. Honest remainder: per-replica-credentials interserver path, real-release-URL via the installer, --secure, ACM and operator end to end are untested.

Tests: tsc --noEmit exit 0. Full npm test under load had 5 timeout-failing files; all pass when rerun alone (docs-only change).

Closes #692

Follow-ups: remaining unverified items (ACM/operator end to end, --secure live, release URL via installer, per-replica credentials, grant floors, next release bundle) are tracked in #697.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P3CopPwrpzeWAJd7vaaLSk