fix: o on an Azure secret opens its page in the portal

Not the vault's list of secrets: the secret's own page (asset/
Microsoft_Azure_KeyVault/Secret/<id>), and in the versions view, the
version's (<id>/<version>), keys' and certificates' versions too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/azure/azure.go

@@ -299,7 +299,7 @@ func (p *Provider) Objects(ctx context.Context, c provider.Container, t provider
 				if s.ID == nil || deref(s.Managed) {
 					continue
 				}
-				out = append(out, secretObject(c, s))
+				out = append(out, secretObject(c, s, p.tenant(c.Source.ID)))
 			}
 		}
 	case provider.TypeKey:
@@ -392,7 +392,7 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 			}
 			for _, s := range page.Value {
 				if s.ID != nil {
-					out = append(out, secretObject(o.Container, s))
+					out = append(out, secretObject(o.Container, s, p.tenant(o.Container.Source.ID)))
 				}
 			}
 		}
@@ -425,8 +425,13 @@ func (p *Provider) Versions(ctx context.Context, o provider.Object) ([]provider.
 	default:
 		return nil, provider.ErrUnsupported
 	}
+	tenant := p.tenant(o.Container.Source.ID)
 	for i := range out {
 		out[i].Reference = versionedReference(out[i])
+		if o.Type != provider.TypeSecret { // secretObject's is the version's already
+			kind := map[provider.ObjectType]string{provider.TypeKey: "Key", provider.TypeCertificate: "Certificate"}[o.Type]
+			out[i].URL = portalAssetURL(tenant, kind, out[i].ID+"/"+out[i].Version) // the version's page
+		}
 	}
 	slices.SortFunc(out, func(a, b provider.Object) int { return b.Updated.Compare(a.Updated) })
 	return out, nil