[enterprise-auth S2] Add a first-class Microsoft Entra ID OAuth/OIDC profile

[rickylabs]

Part of #871

Turn the existing KV OAuth azureAd preset and authorization-code/PKCE flow into
an explicit enterprise Entra profile. Cover tenant authority, supported cloud/
issuer choices, claims and app-role/group mapping, logout, refresh, and
Conditional Access compatibility. Include multi-tenant /common versus
/organizations policy, per-tenant issuer/tid validation, administrator
consent and service-principal creation, consent URL/runbook behavior, and B2B
guest normalization. Document that direct OAuth is not MSAL parity; add an
explicit seam for confidential-client/OBO/downstream API token acquisition
rather than hiding those needs in generic sessions.

Acceptance

• gate: CLI and scaffold select a typed Entra profile without hand-copying a generic issuer configuration
• gate: tenant, common/organizations policy, issuer template, token tid, audience, allow-list, and supported cloud behavior are validated and documented
• gate: administrator-consent and deliberate prompt=consent URLs record customer-tenant consent, service-principal/application identifiers, requested permissions, and revocation/re-consent behavior
• gate: app-only permissions are documented as administrator-consent-only and consent failures produce actionable diagnostics
• gate: B2B guests, including #EXT# UPNs and external identity-provider claims, normalize to tenant-qualified immutable tid + oid identities rather than display/login strings
• gate: authorization code uses PKCE/state/nonce and negative callback cases remain covered
• gate: app roles, groups, the verified 150-SAML/200-JWT group caps, overage lookup, and stable principal mapping have explicit fail-closed behavior
• gate: Conditional Access documentation distinguishes baseline P1 from P2 risk-based policy/Identity Protection and never markets risk enforcement as a P1 capability
• gate: basic Conditional Access compatibility ships with the Entra profile; claims-challenge/continuous-access continuation for long-lived tokens is explicitly phased as later P2/differentiator work and produces a structured reauthentication result without loops when implemented
• gate: confidential-client, OBO, Graph/downstream-token, and cache ownership are either implemented behind a dedicated port or explicitly reported unsupported
• gate: documentation does not claim unverified transparent AD FS discovery through domain_hint
• gate: no documentation describes generic KV OAuth as full MSAL equivalence

Metadata

• Dependencies: EA-00; connection installation feeds EA-04, policy/B2B mapping feeds EA-12, and client-credentials machine identity feeds EA-14.
• Delivery shape: configuration-first Entra preset, followed by Microsoft-specific challenge/token adapter work where required.