fix: don't drop a non-empty Atomic default database during Replicated conversion

[wrn14897]

Summary

ensureReplicaDefaultDatabaseEngine converts the default database from Atomic to Replicated when enableDatabaseSync is enabled. When default already existed with a non-Replicated engine and contained tables, the count > 0 branch logged "data loss is possible" but then fell through and ran DROP DATABASE default SYNC anyway, destroying those tables before recreating default as Replicated.

This makes the code match its documented intent — "It never drops tables or recreates the default database as Replicated if any tables have been created" — by refusing to convert when default is non-empty and not Replicated, and returning an error so the operator reports the problem.

The race this fixes

On a fresh cluster, default starts as Atomic and empty. The operator only converts it to Replicated on a reconcile pass after the replica is Ready (reconcileDatabaseSync operates on readyReplicas). Any client that connects and seeds default in that window — e.g. an OTel collector that auto-creates tables on first export — creates tables in the still-Atomic default. If that seed lands before the operator's first conversion pass, the operator finds a non-empty Atomic default, warns, and drops it. The seeded schema never comes back; downstream consumers loop on Table default.<x> does not exist.

This was hit in the ClickStack helm-charts on the clickhouse-operator-helm v0.0.6 bump (single-replica deployment): all otel_* tables were dropped on first boot. Ref: ClickHouse/ClickStack-helm-charts#240.

Behavior change

default state	Before	After
does not exist	create Replicated	create Replicated (unchanged)
already Replicated	no-op	no-op (unchanged)
Atomic, empty	drop + recreate Replicated	drop + recreate Replicated (unchanged)
Atomic, non-empty	warn, then DROP + recreate Replicated (data loss)	leave intact, return error (operator sets SchemaInSync=false)

Fresh/empty clusters still get the Replicated engine automatically; only a populated default is now preserved.

Why return an error (not skip)

When default is non-empty and not Replicated, the operator cannot perform the requested conversion without losing data. Returning an error propagates through EnsureDefaultDatabaseEngine so the operator sets ClickHouseConditionTypeSchemaInSync = false, surfacing the unconvertible database rather than silently leaving the cluster in a state that does not match the requested topology. The database itself is never dropped. (Per review feedback.)

Test

Added an integration spec (internal/controller/clickhouse/commands_test.go): seed a table with rows into the Atomic default, run EnsureDefaultDatabaseEngine, and assert it reports failure (false) while the engine is still Atomic and the rows survived. The existing Atomic→Replicated conversion spec (empty default) continues to pass.

commander preserves a non-empty Atomic default instead of dropping it [integration]  status="passed"
commander converts default database from Atomic to Replicated [integration]          status="passed"

Full commander suite passes locally (testcontainers).

Notes

• No CRD/API changes; enableDatabaseSync semantics are unchanged.
• This is a data-loss bugfix.