Azure Blob (private container) Agent Chat Display

[rahepler2]

I have worked on a update to the code base to allow for Azure private blobs to be accessible through the Librechat UI to allow for enterprise and gov clients to use the app and stay secure.

Summary
When LibreChat is configured with Azure Blob storage and the container is private (AZURE_STORAGE_PUBLIC_ACCESS=false), two things break:

• Vision/LLM requests fail or degrade. The image is handed to the model as a raw https://.blob.core.windows.net/... URL that remote providers can't fetch.
• The frontend can't display images. The chat points at the same private blob URL, which the browser can't load anonymously (403).
• Both work today only when the container is left publicly accessible, which isn't acceptable for many deployments (enterprise, regulated, sovereign-cloud environments).

Root cause

• getAzureFileStream downloaded via anonymous axios.get(url) instead of the authenticated Azure SDK, so encodeAndFormat silently fell back to passing the URL to the model.
• Azure has no signed-URL strategy (getDownloadURL) like S3's presigned URLs, and getAzureURL returns the bare blob URL, fine only for public containers. An tag can't attach credentials (neither the server's Managed Identity nor the LibreChat JWT), so private images never render.
• The storage endpoint suffix is hardcoded to core.windows.net, so sovereign clouds (GCC High core.usgovcloudapi.net, China core.chinacloudapi.cn) aren't supported.

Proposed fix

• Backend (LLM path): download blobs with the authenticated Azure SDK (Managed Identity / DefaultAzureCredential) and inline base64, matching the existing deleteFileFromAzure pattern. Make encodeAndFormat fail closed (throw) instead of falling back to a private URL the model can't reach.
• Frontend (display path): render private-blob images through the existing authenticated /files/download proxy (which already streams via the server's credentials) and display them from a local blob: URL. No SAS, no extra RBAC role beyond Storage Blob Data Reader. Reuses the same MI mechanism as the backend fix.

Sovereign clouds: parameterize the endpoint suffix via AZURE_STORAGE_ENDPOINT_SUFFIX (defaults to core.windows.net).

This keeps the container fully private while images work end-to-end for both the model and the UI.

https://github.com/rahepler2/LibreChat

[rahepler2]

PR -> #13411