Improve Snowflake action configuration guidance for PAT and OAuth terminology

Problem

Admins configuring the Snowflake action do not get enough Snowflake-specific guidance in the action configuration stepper. The current UI exposes fields such as Password, Key Pair, and OAuth Token, but it does not explain Snowflake terminology or the recommended Programmatic Access Token (PAT) path.

This creates confusion because Snowflake PAT means Programmatic Access Token, and in the Snowflake Python connector a PAT is used through the password-style connection parameter, not through the OAuth token field. A user may incorrectly choose OAuth Token when they actually have a Snowflake PAT.

Requested UX Improvement

Add more contextual guidance to the Snowflake action configuration step in the popup modal/stepper so admins and users understand how to configure Snowflake authentication.

Suggested guidance to include:

• Define PAT as Snowflake Programmatic Access Token.
• Explain that a Snowflake PAT should be entered in the password/secret field using the password authentication method.
• Clarify that the OAuth Token option is only for an actual OAuth access token issued by a configured OAuth flow/provider.
• Explain that Key Pair expects Snowflake key-pair private key material, not an API key string.
• Recommend least-privilege role selection and role-restricted PATs where possible.
• Mention PAT expiration/rotation and secure storage expectations.
• Help users understand the Snowflake account identifier format: omit the snowflakecomputing.com suffix.

Current Implementation Notes

Relevant files:

• application/single_app/templates/_plugin_modal.html
  • Snowflake configuration modal fields and labels.
  • Current auth options: Password, Key Pair, OAuth Token.
• application/single_app/static/js/plugin_modal_stepper.js
  • Snowflake auth method constants and configuration handling.
  • SNOWFLAKE_AUTH_METHOD_PASSWORD, SNOWFLAKE_AUTH_METHOD_KEY_PAIR, SNOWFLAKE_AUTH_METHOD_OAUTH.
  • getSnowflakeConfiguration() maps password auth to auth.type = 'username_password' and the password/PAT secret to auth.key.
  • OAuth maps to auth.type = 'key' and uses the OAuth token value.
• application/single_app/static/json/schemas/snowflake_plugin.additional_settings.schema.json
  • Snowflake field descriptions could be expanded if schema descriptions are surfaced elsewhere.
• docs/explanation/features/v0.250.006/SNOWFLAKE_ACTION.md
  • Existing feature documentation can be used as a source for wording.

Suggested Acceptance Criteria

• Snowflake action configuration stepper includes clear inline help or an info callout explaining Snowflake PAT terminology.
• The password field label/help makes clear that it accepts either a Snowflake password or a Snowflake Programmatic Access Token (PAT), with PAT preferred when configured by the Snowflake admin.
• OAuth wording makes clear it is for OAuth access tokens, not PATs.
• Key-pair wording makes clear it requires private key material.
• Validation/error messages that say “password authentication” are updated where appropriate to avoid implying PAT is unsupported.
• Guidance is visible during both create and edit workflows.
• No secrets are exposed in the UI, logs, docs, or issue examples.

Background

Snowflake documentation describes PAT as Programmatic Access Token. PATs can be used as a password replacement with Snowflake drivers/connectors, while OAuth uses a separate connector path with authenticator = 'oauth' and token = <oauth_access_token>.