snowflake-api skill: hardcoded OAUTH default for SNOWFLAKE_TOKEN_TYPE breaks PAT auth (390303 Invalid OAuth access token)

# Summary

The `snowflake-api` skill's `snow_query.sh` hardcodes `OAUTH` as the default value for `SNOWFLAKE_TOKEN_TYPE`. When the runtime injects a Programmatic Access Token (PAT) as the credential — which is what the Claude Tag Snowflake plugin runtime actually provides — every request is sent with `X-Snowflake-Authorization-Token-Type: OAUTH`, and Snowflake rejects it with:

```
390303: Invalid OAuth access token (HTTP 401)
```

# Root cause

`snowflake/skills/snowflake-api/scripts/snow_query.sh` line 62:

```bash
TOKEN_TYPE="${SNOWFLAKE_TOKEN_TYPE:-OAUTH}"
```

If `SNOWFLAKE_TOKEN_TYPE` is not set by the runtime, the script explicitly sends the `OAUTH` token type header regardless of what kind of credential is actually in `SNOWFLAKE_TOKEN`. Configuring the connection/credential side as PAT does not help, because the script always sends this header with the hardcoded default.

The same default is repeated (intentionally, it seems) in three places, and they contradict each other:

1. `scripts/snow_query.sh` line 62 — the actual behavior: `TOKEN_TYPE="${SNOWFLAKE_TOKEN_TYPE:-OAUTH}"`
2. `scripts/snow_query.sh` line 37 — `usage()` help text: `SNOWFLAKE_TOKEN_TYPE ... (default OAUTH)`
3. `SKILL.md` line 27 — the "Request setup" sample: `export SNOWFLAKE_TOKEN_TYPE="${SNOWFLAKE_TOKEN_TYPE:-OAUTH}" # leave as provided by the runtime`

The comment in (3), "leave as provided by the runtime", contradicts the hardcoded `OAUTH` fallback: when the runtime provides nothing, the script does not leave it alone — it forces `OAUTH`.

# Reproduction

1. Use the skill in an environment where the runtime injects a PAT into `SNOWFLAKE_TOKEN` and does not set `SNOWFLAKE_TOKEN_TYPE`.
2. Run any query via `snow_query.sh`.
3. Snowflake SQL API returns HTTP 401 with error code `390303: Invalid OAuth access token`.

Workaround: explicitly export `SNOWFLAKE_TOKEN_TYPE=PROGRAMMATIC_ACCESS_TOKEN` before every invocation.

# Suggested fix

Since the plugin runtime injects a PAT, change the default to `PROGRAMMATIC_ACCESS_TOKEN` (keeping the env var override for OAuth/other setups), and update all three locations consistently (script default, `usage()` text, and the `SKILL.md` sample).

Happy to send a PR for this.