V2: Snowflake Cortex OAuth login not supported #34780

Summary

The v2 branch does not support the Snowflake Cortex OAuth login. V1 supports it (account-scoped PKCE OAuth with role selection and per-account endpoint); V2 has no Snowflake login method registered.

Part of the systemic V2 provider-login gap (see #34765).

Evidence

• No snowflake-cortex plugin registers a login method in packages/core/src/plugin/provider/ — only openai and opencode register OAuth methods.
• (The provider may exist in the catalog, but without the login + request auth it cannot authenticate.)

How V1 does it (reference)

packages/opencode/src/plugin/snowflake-cortex.ts:

• Collects an account input (myorg-myaccount) and optional role; PKCE OAuth against https://<account>.snowflakecomputing.com/oauth/authorize + /oauth/token-request (HTTP Basic client auth).
• Requires refresh_token in the token response; refreshes via the same account host and persists via client.auth.set (stores accountId in the credential).
• loader custom fetch that, for OAuth credentials: refreshes when expired, requires accountId, and sets Authorization: Bearer <access> (+ User-Agent). The account host determines the endpoint.

What V2 needs

1. Register the Snowflake OAuth login method (account + role inputs; PKCE; Basic client auth) in a V2 snowflake-cortex plugin.
2. Persist the Snowflake account/accountId in credential metadata (needed for both refresh and endpoint).
3. Request-time: derive the per-account base URL from credential metadata and inject Authorization: Bearer <access>; route refresh through V2's integration refresh.

Because the endpoint is account-specific, this is a good test case for the shared credential-aware request hook in #34765 setting endpoint.baseURL from credential.metadata on the native @opencode-ai/llm path.

Environment

• Branch: v2
• Status: verified against source; not runtime-reproduced (requires a Snowflake account).