[datlechin]

Summary

• Snowflake SSO and MFA tokens cached under the old Keychain key are copied to the per-host key and the old item now stays, so a downgrade to 0.83.1 keeps the cached sign-in.
• The old item is read only for a bare account on snowflakecomputing.com and only while the per-host item is missing. A token is never used for another host.
• Clearing a refused token still removes both items, so it never comes back.
• A cached token is cleared only when Snowflake refuses the login, not on a network error, timeout or cancel.
• The token cache moves to SnowflakeTokenCache in TableProSnowflakeCore, shared by both stores and testable there.
• .claude/rules/data-sync-storage.md paths now cover the types persisted to disk, the Keychain, UserDefaults or iCloud, so the release storage check sees them. Adds the Snowflake tokens to the store table.

Test plan

• SnowflakeTokenCacheTests (TableProSnowflakeCoreTests): the old item survives the copy, the per-host key wins afterwards, other hosts never read the old key, clear removes both. Fails with the old copy-then-delete.
• SnowflakeAccountTests pass.
• SnowflakeDriverPlugin builds.