Read Sql Credentials

Issue a short-lived Snowflake OAuth token to the caller's kernel.

A running kernel cannot receive an updated environment, and Snowflake's access tokens are minutes long, so a token injected at kernel start would be dead before the first query. The kernel calls this per connection instead; nothing durable is written into its environment.

Kernel-only, because a kernel holds an internal principal token and no cookie. No browser surface needs a Snowflake token either.