fix: never show one az account's subscriptions under another

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/azure/accounts.go

@@ -151,7 +151,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 	if len(accounts) == 0 {
 		// Not signed in yet: the first call fails with an AuthError and
 		// the UI offers az login.
-		cred := authCredential{cred: newCLICredential("", ""), login: []string{"az", "login"}}
+		cred := authCredential{cred: newCLICredential("", "", nil), login: []string{"az", "login"}}
 		p, err := newWithOptions(cred, options{Settings: s})
 		if err != nil {
 			return nil, err
@@ -171,7 +171,7 @@ func NewAccounts(s Settings) ([]*Provider, error) {
 			label = string(provider.KindAzure) + " · " + labels[i]
 		}
 		cred := authCredential{
-			cred:    newCLICredential(a.anchor, a.tenant),
+			cred:    newCLICredential(a.user, a.tenant, func() ([]account, error) { return readAccounts(path) }),
 			login:   []string{"az", "login", "--tenant", a.tenant},
 			account: label, // so "sign-in required" says which account
 		}