feat: proxy cloud event queries to dq behind DQ_ENDPOINT flag

[elffjs]

Summary

• Adds a DQ_ENDPOINT setting that, when non-empty, forwards all five GraphQL query resolvers to the unified dq service instead of querying ClickHouse/S3 directly.
• Mirrors the forwarding pattern already shipped in telemetry-api (feat/proxy-to-dq), so both services migrate to dq the same way.
• Auth is still validated locally (requireSubjectOptsByDID) before proxying; the raw Authorization header is captured by middleware and forwarded to dq so no re-signing is needed.

Query mapping

fetch-api query	dq query	notes
latestCloudEvent	latestCloudEvent	full payload (header, data, dataBase64, dataUrl)
cloudEvents	cloudEvents	full payload
availableCloudEventTypes	availableCloudEventTypes	passthrough
latestIndex	latestCloudEvent (header only)	returns indexKey: "" since dq dropped that field
indexes	cloudEvents (header only)	returns indexKey: ""

The did argument maps directly to dq's subject (same DID string, no conversion). The resolved canonical subject from requireSubjectOptsByDID is used so device-DID → vehicle-DID linking still works under the proxy.

Test plan

• go build ./... and go test ./... pass
• With DQ_ENDPOINT unset, existing ClickHouse path is unchanged
• With DQ_ENDPOINT=http://dq:3000/query, issue each of the five queries against fetch-api and confirm requests reach dq with the forwarded Authorization header
• Verify latestIndex / indexes return indexKey: "" under the proxy path
• Verify latestCloudEvent / cloudEvents return inline data / dataBase64 / presigned dataUrl as appropriate

🤖 Generated with Claude Code