feat(core): connect Azure through the Azure CLI as an external credential

[neriousy]

Issue for this PR

Closes # (none, follow-up to #53626)

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Moves Azure's Azure CLI sign-in to the external credential type that Bedrock now uses, and lets you pick the resource from a list instead of typing it in.

/connect → Azure
  ├── API key                           enter the resource name (unchanged)
  └── Microsoft Entra ID (Azure CLI)    type: "external"
        resource: picked from the resources your `az login` account can reach,
                  or typed in
        saves: { type: "external", methodID: "azure-cli", metadata: { resourceName } }

• One connection, one resource. If you have several resources, connect once per resource and switch between them, same as before.
• Resource list. Loaded once at startup in a background fiber, so startup never waits on it. It runs only when az is on PATH and the CLI profile (azureProfile.json) shows a signed-in account. The lookup is one Resource Graph query across all subscriptions. If it finds nothing or fails, the field is a plain text input. A resource created after startup won't be listed until restart, but you can type its name.
• Tokens. The old method stored a copy of the CLI token in a fake OAuth credential. Requests and deployment discovery now get a fresh Entra token from az each time.
• Migration. A one-time database migration turns saved oauth / azure-cli credentials into external ones that keep their resource, so nobody has to reconnect and plugin startup doesn't scan credentials.
• Placeholder key in model-resolver.ts. The package checks its credential before the http.request hook runs, so an external credential with no key failed with MissingCredentialError before the Azure plugin could add the bearer token. Azure now gets a placeholder key that the hook replaces. This sits next to Bedrock's sigv4 special case, so they can be cleaned up together.
• TUI. Option descriptions in connect forms weren't indented (paddingLeft was on a <text>, which ignores it). They're now wrapped in a box, like the session form does. This also fixes the Bedrock profile picker.

How did you verify your code works?

• New tests:
  • The resource list, including filtering out names that aren't valid resource names.
  • A typed resource name, and validation of one that isn't valid.
  • The plain text fallback when the CLI lists no resources.
  • The database migration of old OAuth credentials, leaving API keys and other integrations alone.
  • Model resolver: the placeholder auth for Azure and Foundry (Anthropic) packages.
• Existing tests: discovery, request hooks, and startup ordering tests updated for external credentials.
• Commands: bun typecheck in packages/core and packages/tui, plus bun run test in packages/core. The only failures are the existing shell-tool tests, which also fail on v2.
• Manually: went through /connect → Azure → Azure CLI with bun dev, signed in with a real account, at 112 and 60 columns.

Screenshots / recordings

Azure resource                                 esc

1. filipori7-6894-resource
   rg-filipori7-8314 · swedencentral
2. Type your own answer

↑/↓ select · enter confirm · esc cancel

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR