auth: mint tokens from a custom OAuth app

[andy-xu-db]

What this does

Adds ug auth-token --oauth-client-id <id>, so any token ucode mints can come from a custom OAuth app using #516's flow.

The switch lives inside get_databricks_token: if a client id resolves for the requested host, mint through ucode.oauth instead of shelling out to databricks auth token. Deciding there rather than at each call site is what makes all ~50 callers work unchanged, including the agents that mint directly and never touch the argv builders.

Resolution is by host — flag → UCODE_OAUTH_CLIENT_ID (CI) → the host's saved entry — because agents bake --host into their configs and routinely ask about a workspace that isn't current.

Also: ug mcp-proxy --oauth-client-id and both routing hooks accept it; the argv builders pin it into generated configs; has_valid_databricks_auth and run_databricks_login take the custom path, so a missing custom-app session isn't mistaken for the built-in app's live one. DATABRICKS_BEARER still short-circuits ahead of all of it.

ucode configure wiring is #518. Jira: AIGTWY-4550

Testing

uv run pytest 2,322 passed (+32, same 21 pre-existing failures); ruff check, ruff format --check, ty check src/ clean. New tests cover host-keyed resolution, flag/env/state precedence, the get_databricks_token branch, argv pinning, and the login/validity checks.

🥞 Stacked PR

• stack/oauth-pkce-module [Files changed]
  • stack/oauth-auth-token-flag [Files changed] ← this PR
    • stack/oauth-configure-client-id [Files changed]

---

This pull request and its description were written by Isaac.