feat: show who an Azure account signs in as, in Details on its row (#5)

On an Azure account's group row, the Details pane now describes the account:

| field | from |
|---|---|
| name | token `name` |
| user (and "service principal") | az's account list |
| tenant: name · ID | az's account list (the name is borrowed from another entry in the same tenant when az left it out) |
| object ID | token `oid`; `y` on the row copies it |
| sign-in: MFA or not, and how | token `amr` |
| directory roles | token `wids`: built-in roles by name, others as `role 1a2b3c4d`, the default member role left out |
| subs: count · default | az's account list |
| cloud | az's account list, when not AzureCloud |

Nothing is fetched for it: the claims are the ones from the token lazysecrets already gets for the account's own tenant, read without verification. The token itself is never stored or shown. Before the first token, only the az-list fields show. A failing account shows its sign-in problem there instead (from #4).

New optional `provider.Accounts` interface; `azure.Provider` implements it. Tests: the fields from claims and az's list, sign-in methods, the UI showing it on the group row only, and `y` copying the object ID. Checked against a real signed-in account (name, MFA · password, default subscription) and an expired one (az-list fields only, since there's no token).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #5

docs/azure.md

@@ -13,8 +13,17 @@ is listed under each, since their permissions can differ.
 A service principal is used instead when `AZURE_CLIENT_ID`,
 `AZURE_TENANT_ID` and a secret or certificate are set in the environment.
 
-If your az login expires mid-session, the status line says so: press `L` to
-run `az login` without leaving lazysecrets, and everything reloads.
+On an account's group row, the Details pane shows who it signs in as: name,
+user, tenant, object ID, whether the session used MFA, directory roles
+(built-in ones by name) and its subscriptions. It's read from az's account
+list and the token lazysecrets already has, so nothing is fetched for it.
+`y` there copies the object ID, the one access policies and role
+assignments ask for.
+
+If an account's az login has expired, the status line says so once, and the
+Details pane on that account's rows says it until you sign in: press `L`
+there to run `az login` for it without leaving lazysecrets, and everything
+reloads.
 
 ## Permissions
 

docs/keys.md

@@ -48,7 +48,7 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s |
+| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |