fix(databricks): resolve account_id in OAuth2 endpoints, preserve configured URIs

The per-cloud OAuth2 endpoint templates carry a `{}` placeholder for the
Databricks account id (or Azure tenant id) that was never substituted, so
auto-detected authorize/token URLs were emitted as `.../accounts/{}/v1/...`.
The authorization-URI methods also unconditionally overwrote a fully-resolved
`authorization_request_uri` supplied via DATABASE_OAUTH2_CLIENTS.

- Add `_resolve_oauth2_endpoint`: substitutes `account_id`/`tenant_id` from the
  database extra into the template, or raises OAuth2Error when absent instead of
  issuing a request to an unresolved endpoint.
- Preserve a configured `authorization_request_uri`; only auto-detect/resolve
  when none is set.
- `get_oauth2_token` has no database context to auto-detect, so fail fast on a
  missing `token_request_uri` rather than POST to `.../{}/v1/token`.
- Cover auto-detect/resolve, preserve-configured, and fail-fast paths for both
  the native and Python-connector specs; document `account_id`/`tenant_id`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/user_docs_versioned_docs/version-6.0.0/configuration/databases.mdx

@@ -575,15 +575,31 @@ Superset automatically detects your Databricks cloud provider and uses the appro
 - **Azure**: Detected from hostnames containing `azure` or `azuredatabricks`
 - **GCP**: Detected from hostnames containing `gcp` or `googleusercontent`
 
-You can also explicitly specify the cloud provider in your database configuration under **Advanced** → **Other** → **ENGINE PARAMETERS**:
+You can also explicitly specify the cloud provider, along with the account
+identifier used to build the OAuth2 endpoints, in your database configuration
+under **Advanced** → **Other** → **ENGINE PARAMETERS**:
 
 ```json
 {
-  "cloud_provider": "azure"
+  "cloud_provider": "azure",
+  "tenant_id": "your-azure-tenant-id"
 }
 ```
 
-Valid cloud provider values are: `aws`, `azure`, `gcp`.
+For AWS and GCP, supply `account_id` instead:
+
+```json
+{
+  "cloud_provider": "aws",
+  "account_id": "your-databricks-account-id"
+}
+```
+
+Valid cloud provider values are: `aws`, `azure`, `gcp`. When the OAuth2 endpoints
+are auto-detected, Superset substitutes this identifier into the provider's
+endpoint template. If you instead supply fully-resolved `authorization_request_uri`
+and `token_request_uri` values in `DATABASE_OAUTH2_CLIENTS`, those take precedence
+and no `account_id`/`tenant_id` is required.
 
 ###### Usage