feat: show who an Azure account signs in as, in Details on its row (#5)

On an Azure account's group row, the Details pane now describes the account:

| field | from |
|---|---|
| name | token `name` |
| user (and "service principal") | az's account list |
| tenant: name · ID | az's account list (the name is borrowed from another entry in the same tenant when az left it out) |
| object ID | token `oid`; `y` on the row copies it |
| sign-in: MFA or not, and how | token `amr` |
| directory roles | token `wids`: built-in roles by name, others as `role 1a2b3c4d`, the default member role left out |
| subs: count · default | az's account list |
| cloud | az's account list, when not AzureCloud |

Nothing is fetched for it: the claims are the ones from the token lazysecrets already gets for the account's own tenant, read without verification. The token itself is never stored or shown. Before the first token, only the az-list fields show. A failing account shows its sign-in problem there instead (from #4).

New optional `provider.Accounts` interface; `azure.Provider` implements it. Tests: the fields from claims and az's list, sign-in methods, the UI showing it on the group row only, and `y` copying the object ID. Checked against a real signed-in account (name, MFA · password, default subscription) and an expired one (az-list fields only, since there's no token).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #5

internal/provider/azure/accounts.go

@@ -19,7 +19,10 @@ import (
 // account is one az CLI identity in one tenant.
 type account struct {
 	user, tenant  string
+	userType      string // "user" or "servicePrincipal"
 	tenantName    string
+	cloud         string // az's environment: AzureCloud, AzureChinaCloud, …
+	defaultSub    string // az's default subscription's name, if this account's
 	anchor        string // a subscription az maps to this account, to pin it
 	anchorEnabled bool
 	isDefault     bool
@@ -52,12 +55,15 @@ func readAccounts(path string) ([]account, error) {
 	var profile struct {
 		Subscriptions []struct {
 			ID         string `json:"id"`
+			Name       string `json:"name"`
 			State      string `json:"state"`
 			IsDefault  bool   `json:"isDefault"`
 			TenantID   string `json:"tenantId"`
 			TenantName string `json:"tenantDisplayName"`
+			Cloud      string `json:"environmentName"`
 			User       struct {
 				Name string `json:"name"`
+				Type string `json:"type"`
 			} `json:"user"`
 		} `json:"subscriptions"`
 	}
@@ -72,7 +78,7 @@ func readAccounts(path string) ([]account, error) {
 		}
 		i := slices.IndexFunc(out, func(a account) bool { return a.user == s.User.Name && a.tenant == s.TenantID })
 		if i < 0 {
-			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName})
+			out = append(out, account{user: s.User.Name, tenant: s.TenantID, tenantName: s.TenantName, userType: s.User.Type, cloud: s.Cloud})
 			i = len(out) - 1
 		}
 		a := &out[i]
@@ -82,12 +88,21 @@ func readAccounts(path string) ([]account, error) {
 		enabled := s.State == "Enabled"
 		switch {
 		case s.IsDefault:
-			a.anchor, a.anchorEnabled, a.isDefault = s.ID, enabled, true
+			a.anchor, a.anchorEnabled, a.isDefault, a.defaultSub = s.ID, enabled, true, s.Name
 		case a.isDefault:
 		case a.anchor == "" || enabled && !a.anchorEnabled:
 			a.anchor, a.anchorEnabled = s.ID, enabled
 		}
 	}
+	// az leaves the tenant's name out of some entries: take it from
+	// another in the same tenant.
+	for i := range out {
+		for _, b := range out {
+			if out[i].tenantName == "" && b.tenant == out[i].tenant {
+				out[i].tenantName = b.tenantName
+			}
+		}
+	}
 	slices.SortStableFunc(out, func(a, b account) int {
 		if a.isDefault != b.isDefault {
 			if a.isDefault {
@@ -179,6 +194,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 		if err != nil {
 			return nil, err
 		}
+		p.account = &accountDetails{account: a, claims: cred.cred.(*cliCredential).claims}
 		if label != "" {
 			p.id = string(provider.KindAzure) + ":" + a.user + "/" + a.tenant
 			p.label = label