refactor: no group list in an account's details, and no Microsoft Graph call for it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/azure.md

@@ -16,12 +16,10 @@ A service principal is used instead when `AZURE_CLIENT_ID`,
 On an account's group row, the fourth pane shows who it signs in as: name,
 user, tenant, object ID, whether the session used MFA, directory roles
 (built-in ones by name) and its subscriptions, read from az's account list
-and the token lazysecrets already has. Below them are the groups the
-account is in, nested ones too: those come from Microsoft Graph, once a
-session, the first time the pane shows them. `y` on the row copies the
-object ID, the one access policies and role assignments ask for; `tab`
-goes into the pane, where `j`/`k` pick any field or group, `/` filters
-them (`/tenant`, `/platform`) and `y` copies the selected one.
+and the token lazysecrets already has: no requests of their own. `y` on
+the row copies the object ID, the one access policies and role
+assignments ask for; `l` goes into the pane, where `j`/`k` pick any
+field, `/` filters them (`/tenant`) and `y` copies the selected one.
 
 If an account's az login has expired, the status line says so once, and the
 Details pane on that account's rows says it until you sign in: press `L`