fix: support tcp with TLS (port 9440) for otelcol migrator (#1783)

## Summary
- Add support for TLS-enabled ClickHouse endpoints in otelcol migrator (`tcps://`, `tls://`, `clickhouse://` schemes)
- Support `?secure=true` query parameter to override TLS setting on any scheme
- Default TLS port to `9440` for `tcps`/`tls` schemes
- Improve error message for unsupported schemes to list valid options

## Test plan
- Added tests for `clickhouse://`, `tcps://`, `tls://` schemes with default and custom ports
- Added tests for `?secure=true` query param on `tcp` and `http` schemes
- Added test verifying `?secure=false` is a no-op

Docs: https://clickhouse.com/docs/guides/sre/network-ports

Ref: HDX-3490

.changeset/cuddly-points-sneeze.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/otel-collector": patch
+---
+
+fix: support tcp with TLS (tcps/tls schemes) and ?secure=true query param in otelcol migrator

packages/otel-collector/cmd/migrate/main.go

@@ -144,9 +144,13 @@ func parseEndpoint(endpoint string) (protocol string, host string, port string,
 	}
 
 	switch u.Scheme {
-	case "tcp":
+	case "tcp", "clickhouse":
 		protocol = "native"
 		port = getOrDefault(u.Port(), "9000")
+	case "tcps", "tls":
+		protocol = "native"
+		port = getOrDefault(u.Port(), "9440")
+		secure = true
 	case "http":
 		protocol = "http"
 		port = getOrDefault(u.Port(), "8123")
@@ -155,7 +159,12 @@ func parseEndpoint(endpoint string) (protocol string, host string, port string,
 		port = getOrDefault(u.Port(), "8443")
 		secure = true
 	default:
-		return "", "", "", false, fmt.Errorf("unsupported protocol: %s", u.Scheme)
+		return "", "", "", false, fmt.Errorf("unsupported protocol scheme: %s (supported: tcp, clickhouse, tcps, tls, http, https)", u.Scheme)
+	}
+
+	// Allow ?secure=true query parameter to override TLS setting
+	if strings.EqualFold(u.Query().Get("secure"), "true") {
+		secure = true
 	}
 
 	return protocol, host, port, secure, nil

packages/otel-collector/cmd/migrate/main_test.go

@@ -190,6 +190,56 @@ func TestParseEndpoint(t *testing.T) {
 			input:    "https://clickhouse.example.com",
 			protocol: "http", host: "clickhouse.example.com", port: "8443", secure: true,
 		},
+		{
+			name:     "clickhouse scheme with port",
+			input:    "clickhouse://ch.example.com:9000",
+			protocol: "native", host: "ch.example.com", port: "9000", secure: false,
+		},
+		{
+			name:     "clickhouse scheme default port",
+			input:    "clickhouse://ch.example.com",
+			protocol: "native", host: "ch.example.com", port: "9000", secure: false,
+		},
+		{
+			name:     "tcps scheme with port",
+			input:    "tcps://ch.example.com:9440",
+			protocol: "native", host: "ch.example.com", port: "9440", secure: true,
+		},
+		{
+			name:     "tcps scheme default port",
+			input:    "tcps://ch.example.com",
+			protocol: "native", host: "ch.example.com", port: "9440", secure: true,
+		},
+		{
+			name:     "tcps scheme custom port",
+			input:    "tcps://ch.example.com:19440",
+			protocol: "native", host: "ch.example.com", port: "19440", secure: true,
+		},
+		{
+			name:     "tls scheme with port",
+			input:    "tls://ch.example.com:9440",
+			protocol: "native", host: "ch.example.com", port: "9440", secure: true,
+		},
+		{
+			name:     "tls scheme default port",
+			input:    "tls://ch.example.com",
+			protocol: "native", host: "ch.example.com", port: "9440", secure: true,
+		},
+		{
+			name:     "tcp with secure query param",
+			input:    "tcp://hostname:9440?secure=true",
+			protocol: "native", host: "hostname", port: "9440", secure: true,
+		},
+		{
+			name:     "http with secure query param",
+			input:    "http://hostname:8443?secure=true",
+			protocol: "http", host: "hostname", port: "8443", secure: true,
+		},
+		{
+			name:     "secure query param false is no-op",
+			input:    "tcp://hostname:9000?secure=false",
+			protocol: "native", host: "hostname", port: "9000", secure: false,
+		},
 		{
 			name:     "no scheme defaults to tcp",
 			input:    "clickhouse:9000",