feat(core): add Snowflake Cortex browser OAuth - #47139

Ports Snowflake Cortex browser OAuth from V1 to the V2 plugin system, scoped to the Snowflake provider.

What

• Registers a browser OAuth method on the snowflake-cortex integration with account (required) and role (optional) form prompts.
• PKCE (S256) authorization against the account-specific issuer https://<account>.snowflakecomputing.com using Snowflake's built-in LOCAL_APPLICATION client, with a per-attempt loopback callback server on 127.0.0.1 (ephemeral port, closed via the attempt scope).
• Code exchange and refresh at /oauth/token-request; refresh is driven by Integration's existing expiry handling and reads the account from credential metadata.
• Role scope encoding preserved from V1 (session:role:<ROLE> / session:role-encoded:<...>).
• Under a browser-OAuth connection, a catalog transform substitutes the account into the models.dev ${SNOWFLAKE_ACCOUNT} endpoint template and reloads on credential switch. Under a PAT/key connection the template is untouched, so SNOWFLAKE_ACCOUNT + SNOWFLAKE_CORTEX_PAT/SNOWFLAKE_CORTEX_TOKEN keep working as before.
• The existing sdk hook and cortexFetch quirks are unchanged; the OAuth access token already reaches evt.options.apiKey via the model resolver.

V1 behavior deliberately not ported

• Plugin-side per-request 401 retry / token refresh / OAUTH_DUMMY_KEY loader — Integration owns refresh in V2.
• Module-level singleton callback server, pending-attempt supersede logic, and hard 5-minute timeout — replaced by per-attempt scoped server plus Integration attempt lifetime/cancel.
• open(url) auto-launch — clients open the attempt URL, as with other providers.
• V1's manual "paste PAT" method with an account prompt — the default key method remains; PAT users still set SNOWFLAKE_ACCOUNT.
• Forced User-Agent on model requests — only set on token endpoints now.

Tests

packages/core/test/plugin/provider-snowflake-cortex.test.ts extended: method registration shape, live oauth.connect (issuer, PKCE, scope, loopback redirect, forged-state rejection through the real listener), role scope encoding, blank-account rejection, endpoint expansion under OAuth vs. key credentials, and re-expansion on credential switch. Existing PAT and cortexFetch tests unchanged and passing.

bun typecheck from packages/core passes.