feat(auth): add Entra ID headless-auth strategy for parity with Keycloak and Okta

Summary

Add a Microsoft Entra ID (formerly Azure AD) login-form strategy to src/vip/idp.py so that --headless-auth supports Entra with the same first-class parity we already give Keycloak and Okta.

Why this matters

Customer prevalence. A large share of Posit Team customers standardize on Microsoft Entra ID as their corporate IdP — it ships with M365/Azure tenants, so for many enterprises it's the default rather than a deliberate choice. Today VIP can headlessly authenticate against Keycloak, Okta, and Snowflake, but a customer on Entra falls back to interactive auth and can't exercise the full headless session-launch / API-key flows the other IdPs get.

Docs already treat Entra as a peer of Okta. Posit's product documentation for Workbench and Connect heavily features both Okta and Entra/Azure AD as the two headline enterprise SSO integrations, with dedicated OIDC/SAML configuration guides for each. Our verification tooling should reflect the same reality the docs sell: if we tell customers Entra is a fully-supported, documented integration, VIP should be able to verify a deployment authenticated through it end-to-end. Right now there's a gap between what the docs promote (Okta and Entra) and what VIP can headlessly test (Okta but not Entra).

Current state

src/vip/idp.py registers strategies in _IDP_STRATEGIES:

_IDP_STRATEGIES = {
    "keycloak": _fill_keycloak_login,
    "okta": _fill_okta_login,
    "snowflake": _fill_snowflake_login,
}

There is no entra / azure entry, and no Entra form-filler. get_idp_strategy() raises AuthConfigError: Unsupported IdP for Entra.

Proposed work

• Add _fill_entra_login(page, username, password) modeling Entra's multi-step OIDC login flow:
  • email/UPN entry (input[name='loginfmt']) → Next
  • password entry (input[name='passwd']) → Sign in
  • the "Stay signed in?" (KMSI) interstitial (#idSIButton9 / "Yes") — easy to miss, stalls the redirect if unhandled
  • optional MFA / authenticator challenge (mirror the Okta TOTP handling; honor VIP_TEST_TOTP_SECRET)
• Register "entra" in _IDP_STRATEGIES (consider aliasing "azure" / "azuread" → same strategy for config ergonomics).
• Verbose _log_verbose breadcrumbs at each hop, consistent with the Keycloak/Okta strategies.
• Extend the mock-IdP E2E coverage (see #419 / #430) to include an Entra flow where feasible, or document why Entra can't be mocked and how it's validated instead.
• Update auth docs / vip.toml.example to list Entra as a supported auth_provider IdP.

Acceptance criteria

vip verify --headless-auth against a Workbench/Connect deployment fronted by Entra ID completes login (including KMSI and MFA) without interactive intervention, reaching parity with the existing Keycloak and Okta strategies.

References

• src/vip/idp.py — _IDP_STRATEGIES, get_idp_strategy, existing _fill_keycloak_login / _fill_okta_login
• Related IdP/auth issues: #263, #419, #430

Start in src/vip/idp.py with _IDP_STRATEGIES, get_idp_strategy, and the existing _fill_keycloak_login and _fill_okta_login implementations. Review related mock-IdP coverage in #419 and #430, then inspect the auth docs and vip.toml.example. Done means Entra headless login handles its listed steps, MFA where feasible, verbose breadcrumbs, coverage or validation documentation, and supported-provider documentation.