auth: search-as-you-type picker and visual distinction for action items (#5222)

Stacked on top of #5218.

## Why

Two follow-up refinements after the picker rework in #5218:

1. The picker only entered search mode automatically when there were
more than 5 profiles. For smaller lists the user had to press `/` to
type-to-filter, which most people don't know.
2. The action entries (`Create a new profile`, `Enter a host URL
manually`) sat in the list visually identical to real profiles, even
though they're functionally different.

## Changes

**Before:** Typing in the picker only filtered the list when
`len(profiles) > 5`. Action items rendered the same as profiles.

**Now:**

- Picker always starts in search mode, so typing immediately filters the
list. The cursor stays on the top remaining match — Enter takes that
one. This is the "type, options shrink, top match is the suggestion" UX.
- Action items render as faint text with `+` / `→` prefixes and no
host/account suffix, so the list visually reads "profiles above, actions
below" without needing a literal separator.
- The searcher always returns true for action entries, so they stay
visible no matter what the user types. If the typed query matches
nothing, the user can still pick `+ Create a new profile` or `→ Enter a
host URL manually` from the same screen.

## Test plan

- [x] Existing unit tests for `buildPickerItems` and acceptance tests
for `auth switch` / `auth logout` / `auth token` / `auth login` continue
to pass.
- [x] `./task checks`, `./task fmt-q`, `./task lint-q` are clean.
- [x] Built locally and exercised the picker manually with 1, 3, and 8
profiles to confirm the search field is always visible and the action
entries always appear in the filtered list.

This pull request and its description were written by Isaac.

Author: simonfaltum

NEXT_CHANGELOG.md

@@ -6,6 +6,7 @@
 
 * `databricks auth describe` now reports where U2M (`databricks-cli`) tokens are stored: `plaintext` (`~/.databricks/token-cache.json`) or `secure` (OS keyring), and the source of the choice (env var, config setting, or default).
 * Marked the default profile in the interactive pickers shown by `databricks auth switch`, `databricks auth logout`, `databricks auth token`, and `databricks auth login`, and moved it to the top of the list. `databricks auth login` and `databricks auth logout` now offer the same selectors as `databricks auth token` and `databricks auth switch` respectively.
+* The interactive auth profile pickers now start in search mode so typing immediately filters the list, and the action entries (`+ Create a new profile`, `→ Enter a host URL manually`) are visually distinct from real profiles and stay visible regardless of the search query.
 
 ### Bundles
 * Stop applying `presets.name_prefix` (and the dev-mode `[dev <user>]` rename) to `vector_search_endpoints` ([#5209](https://github.com/databricks/cli/pull/5209)).

cmd/auth/profile_picker.go

@@ -19,8 +19,8 @@ const (
 )
 
 const (
-	profilePickerCreateNewLabel = "Create a new profile"
-	profilePickerEnterHostLabel = "Enter a host URL manually"
+	profilePickerCreateNewLabel = "+ Create a new profile"
+	profilePickerEnterHostLabel = "→ Enter a host URL manually"
 )
 
 // profilePickerOptions configures pickAuthProfile.
@@ -114,16 +114,22 @@ func pickAuthProfile(ctx context.Context, profiles profile.Profiles, opts profil
 	idx, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
 		Label:             opts.Label,
 		Items:             items,
-		StartInSearchMode: len(profiles) > 5,
+		StartInSearchMode: true,
 		Searcher: func(input string, index int) bool {
+			// Action entries (Create new / Enter host) stay visible regardless
+			// of the search query so the user can always reach them, including
+			// when the typed query doesn't match any profile.
+			if items[index].IsExtra {
+				return true
+			}
 			input = strings.ToLower(input)
 			return strings.Contains(strings.ToLower(items[index].Name), input) ||
 				strings.Contains(strings.ToLower(items[index].Host), input) ||
 				strings.Contains(strings.ToLower(items[index].AccountID), input)
 		},
 		LabelTemplate: "{{ . | faint }}",
-		Active:        `▸ {{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}`,
-		Inactive:      `  {{.Name}}{{if .IsDefault}} [default]{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}`,
+		Active:        `▸ {{if .IsExtra}}{{.Name | faint | bold}}{{else}}{{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}{{end}}`,
+		Inactive:      `  {{if .IsExtra}}{{.Name | faint}}{{else}}{{.Name}}{{if .IsDefault}} [default]{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}{{end}}`,
 		Selected:      `{{ "` + noun + `" | faint }}: {{ .Name | bold }}`,
 	})
 	if err != nil {