fix: fail-fast Azure abs:// auth validation in container entrypoint

[Copilot]

The abs:// branch in check_litestream_replica_url only caught partial service-principal credentials but never failed when no auth mechanism was configured — a misconfigured deployment would pass entrypoint validation and crash when Litestream started.

Changes

• Explicit three-path enforcement in the ABS://*) case — restructured from a single partial-SP guard into an if/elif/else chain:

  Path	Signal	Behaviour
  Account key	LITESTREAM_AZURE_ACCOUNT_KEY set	pass
  Service principal	any AZURE_CLIENT_* var set	all three required; missing vars still emit named errors
  Managed identity	IDENTITY_ENDPOINT or MSI_ENDPOINT present	pass (covers Container Apps, App Service, legacy runtimes)
  None	—	emit actionable hints + log_error to terminate

• Readable error output — the no-auth case emits log_warn hint lines enumerating all three options before the terminal log_error, instead of a single unwieldy message.

# With no credentials configured, output is now:
WARN: Azure Blob Storage ('abs://') requires one of:
WARN:   1. Account key:       set 'LITESTREAM_AZURE_ACCOUNT_KEY'
WARN:   2. Service principal: set 'AZURE_CLIENT_ID', 'AZURE_TENANT_ID', and 'AZURE_CLIENT_SECRET'
WARN:   3. Managed identity:  enable managed identity on the hosting platform
WARN:                         ('IDENTITY_ENDPOINT' or 'MSI_ENDPOINT' must be set by the Azure runtime)
ERROR: No Azure authentication mechanism configured for 'abs://' replica URL.