[Lee-W]

SnowflakeCortexAgentHook only accepted an OAuth access token, so ones whose
Snowflake connections use key-pair or programmatic access tokens could not
call Cortex Agents without a second, OAuth-only connection. The SQL API hook
already minted all 3 header kinds; pulling that logic into a shared token
provider lets both hooks authenticate the same way and keeps a key-pair JWT
cached across requests until its renewal window, instead of re-signing on
every call. A renewal delta at or beyond the token lifetime now re-signs every
call rather than handing out an expired JWT.

It also adds PydanticAISnowflakeHook (the pydanticai_snowflake connection
type), which points a Common AI model at an existing Snowflake connection, so
Cortex chat completions reuse the same credentials.

A connection with authenticator: programmatic_access_token and the PAT in
Password now also works for SnowflakeHook, so one connection serves the SQL
connector, the SQL API hook and both Cortex hooks. Without a host extra, the
Cortex base URL now appends the connection's region the way
SnowflakeHook.account_identifier does, so locator-style accounts outside AWS
us-west-2 reach the right host; a connection that uses an org-account
identifier but still sets region gets a region-suffixed host, as the SQL API
hook already does.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: [Claude] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[kaxil]

Thanks, LGTM