The _make_cursor helper uses MagicMock for the connection, which
auto-creates truthy attributes. Without explicitly setting
_custom_credential = None, the bulk copy code takes the custom
credential path instead of the expected _auth_type path.

Rename the public API parameter from 'credential' to 'token_provider'
to reduce ambiguity in our multi-auth-path context. 'credential' could
be confused with SQL auth username/password; 'token_provider' clearly
signals token-based Entra ID auth.

- Rename parameter: credential -> token_provider (connect, Connection)
- Rename internal attr: _custom_credential -> _token_provider
- Update error messages, docstrings, comments, .pyi stubs
- Improve docstring with usage example and explicit guidance
- All 97 tests pass

…ial-support

# Conflicts:
#	mssql_python/cursor.py
#	tests/test_008_auth.py

…lk-copy token branch

C2: capture token expires_on from custom credential and store on connection. C3: raise DB-API InterfaceError/OperationalError instead of ValueError/TypeError for token_provider misuse and acquisition failures. Add unit tests covering the cursor bulk-copy token_provider branch (success, get_token failure, invalid token).

…ol typing; fix docstring error type

- auth.py: type credential params as TokenProvider Protocol; hard-code commercial-cloud scope
- connection.py: warn on ignored UID/PWD/Trusted_Connection when token_provider set; validate get_token arity; document token lifecycle limitations
- db_connection.py: note sovereign clouds out of scope
- test_008_auth.py: cover arity validation and dropped-credential warning

…al collision

The native connection pool keys on the sanitized connection string only, and
the access token lives in attrs_before (applied once on a new physical
connection, never re-applied on reuse). Two different principals sharing the
same Server/Database collapsed into one pool bucket, so one caller could be
handed another's authenticated connection (silent identity confusion).

Fix: Connection.__init__ disables pooling whenever SQL_COPT_SS_ACCESS_TOKEN is
present in attrs_before. One condition covers all access-token paths: raw
attrs_before token, built-in Authentication=ActiveDirectory* (token-injecting),
and token_provider=. Driver-native paths (e.g. ServicePrincipal) keep creds in
the connection string and remain poolable.

Adds regression tests in TestTokenProviderPooling.

- Remove unnecessary f-prefix from two non-interpolated SQL_WCHAR error
  strings in connection.py (flagged by flake8-no-fstring-u style linters).
- Type token_provider as Optional[TokenProvider] (was Optional[object]) in
  the .pyi stubs for Connection.__init__ and connect(), matching the runtime.

- Drop the 'See docs/DESIGN_TOKEN_PROVIDER_SUPPORT.md' comment in connection.py
  (that file is not part of the PR).
- The expired-token warning in _get_token_from_credential is reached via two
  call chains at different depths (connect vs bulk-copy), so a fixed stacklevel
  cannot point at user code for both. Compute the stacklevel dynamically via
  _stacklevel_to_caller(), which walks out of the package to the first external
  frame. Works across all supported Python versions.