feat(databricks-volume): add Python token provider authentication

[sonhmai]

What changed

• Separate Databricks volume location config from runtime authentication.
• Add public TokenProvider, StaticTokenProvider, and DatabricksProfileTokenProvider APIs.
• Route core volume operations through a Mirage-owned async Files client instead of exposing the Databricks SDK client.
• Resolve tokens per Files API operation, including deferred stream reads.
• Require a complete resource override when loading Databricks volume snapshots because token providers are not serialized.
• Update Python tests, examples, and docs for the new API.

Why

Passing a fixed token into SDK config can conflict with OAuth credentials injected by Databricks Apps. It also prevents cached resources from using rotating or request-scoped OBO tokens.

This keeps authentication under application control and gives Mirage an internal client boundary that can move from the Databricks SDK to HTTP later without changing the public resource API.

Scope

Python implementation only. TypeScript parity remains tracked in #289.

Verification

• PYTHONPATH=. /Users/son/code/mirage/python/.venv/bin/python -m pytest tests/core/databricks_volume tests/resource/databricks_volume tests/resource/test_state_round_trip.py -q --no-cov
• Python pre-commit hooks
• Codex and Claude autoreview; accepted findings for SDK multipart uploads, deferred stream authentication, and profile config reuse were fixed

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
struktoai	🟢 Ready	View Preview	Jun 12, 2026, 12:09 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[sonhmai]

still WIP