P0-3: Azure OpenAI provider

Problem

LiteLLM ships native Azure OpenAI. ai-gateway has none — Azure customers (the larger half of OpenAI's enterprise revenue) cannot route through us.

Scope

DP (moonming/ai-gateway)

• New crate crates/aisix-provider-azure-openai/ (or extend openai crate with with_azure_endpoint(...)).
• Endpoint shape: POST {base}/openai/deployments/{deployment}/chat/completions?api-version={version} + the embeddings + completions variants.
• Auth header: api-key: <key> (NOT Authorization: Bearer) by default; also support Entra ID OAuth2 Authorization: Bearer <token> mode.
• Streaming SSE works (Azure OpenAI has same SSE shape as OpenAI).

CP (api7/api7ee-3-control-plane)

• Provider enum: add azure_openai.
• Credential additional fields: api_base (Azure endpoint URL), api_version, deployment_id. Or keep provider_config JSONB flexible and document the Azure-required keys.
• Optional: separate auth_mode field (api_key vs entra_id) for Entra path.

Dashboard UI (api7/AISIX-Cloud)

• Provider picker adds Azure OpenAI.
• Credential form: api_base + api_version + auth mode (key OR Entra) + key/tenant/client_id/client_secret.
• Model form: deployment_id field becomes required when provider=azure_openai.

e2e

• Mock Azure OpenAI endpoint shape (it's OpenAI-compatible enough to extend the existing mock-llm).

Estimate

DP 2-3d, CP 1d, UI 1d, e2e 0.5d

Start with the existing provider implementation in crates/aisix-provider-azure-openai/ or the openai crate, then inspect the control-plane provider enum and credential fields, the AISIX-Cloud provider and model forms, and the existing mock-llm e2e setup. Done means Azure OpenAI chat, embeddings, completions, streaming, both auth modes, control-plane credentials, dashboard configuration, and mocked end-to-end coverage work across the listed components.