feat: an account pane on Azure account rows: fields and groups to move through and copy

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/azure.md

@@ -13,12 +13,15 @@ is listed under each, since their permissions can differ.
 A service principal is used instead when `AZURE_CLIENT_ID`,
 `AZURE_TENANT_ID` and a secret or certificate are set in the environment.
 
-On an account's group row, the Details pane shows who it signs in as: name,
+On an account's group row, the fourth pane shows who it signs in as: name,
 user, tenant, object ID, whether the session used MFA, directory roles
-(built-in ones by name) and its subscriptions. It's read from az's account
-list and the token lazysecrets already has, so nothing is fetched for it.
-`y` there copies the object ID, the one access policies and role
-assignments ask for.
+(built-in ones by name) and its subscriptions, read from az's account list
+and the token lazysecrets already has. Below them are the groups the
+account is in, nested ones too: those come from Microsoft Graph, once a
+session, the first time the pane shows them. `y` on the row copies the
+object ID, the one access policies and role assignments ask for; `tab`
+goes into the pane, where `j`/`k` pick any field or group and `y` copies
+it.
 
 If an account's az login has expired, the status line says so once, and the
 Details pane on that account's rows says it until you sign in: press `L`