feat(core): add Snowflake Cortex browser OAuth login - #47151

Ports the V1 Snowflake Cortex browser OAuth flow to the V2 plugin system as an IntegrationOAuthMethodRegistration on the snowflake-cortex integration.

What changed

packages/core/src/plugin/provider/snowflake-cortex.ts

• Registers a browser OAuth method ("Login with Snowflake (External Browser)") with account (required) and role (optional) form fields.
• authorize: normalizes the account (strips scheme / .snowflakecomputing.com / trailing slashes), generates PKCE + state, starts an ephemeral 127.0.0.1 loopback listener (lazy node:http, closed by scope finalizer), and returns the account-specific https://<account>.snowflakecomputing.com/oauth/authorize URL using the LOCAL_APPLICATION public client. Role maps to session:role:<ROLE> or session:role-encoded:<...> scope as in V1.
• Callback validates state / error / missing code, then exchanges the code at /oauth/token-request with Basic LOCAL_APPLICATION:LOCAL_APPLICATION.
• refresh: refresh-token grant against the account stored in credential metadata; keeps the prior refresh token if the response omits one.
• Credential metadata is { account, baseURL }. The model resolver already projects OAuth metadata into provider settings, so baseURL replaces the catalog's ${SNOWFLAKE_ACCOUNT} template and the access token becomes the bearer apiKey on both the native and sdk-hook paths. No changes to the existing sdk hook, cortexFetch, or PAT/env handling.
• label shows the account on the stored credential.

packages/core/test/plugin/provider-snowflake-cortex.test.ts

• Method registration + form shape; authorize URL (issuer, PKCE, state, loopback redirect); account normalization + role scope encoding; empty-account rejection; resolver wiring (metadata baseURL + bearer token); loopback callback error and state-mismatch paths via a real request to the listener. Existing PAT and cortexFetch tests unchanged.

V1 behavior deliberately dropped

• Plugin-side open(url): V2 clients open attempt.url.
• Plugin-owned 5-minute timeout and module-level server/pending-auth singletons: the core attempt lifetime and per-attempt scope own this now.
• Pre-flight expiry check and 401-triggered retry inside a custom fetch: core refreshes via connection.resolve when the token is within 5 minutes of expiry, consistent with the other V2 OAuth providers.
• Separate "Paste PAT" method with an account prompt: the models.dev-registered key/env methods remain as-is.

Verification

• bun typecheck in packages/core
• bun test test/plugin/provider-snowflake-cortex.test.ts in packages/core (21 pass)