Add Azure Blob Storage File Sync

[paullizer]

Summary

• add Azure Blob Storage as an admin-controlled File Sync source for personal, group, and public workspaces
• support account/container/prefix normalization, virtual-path browsing, ETag change detection, connection tests, and streamed downloads
• accept storage connection strings, full container SAS URLs, and standalone SAS tokens; pasted URLs derive canonical account/container fields and a default source name
• support Blob secret persistence with Key Vault enabled or disabled; Key Vault is preferred when configured
• validate connections with only required List and blob Read operations, avoiding Get Container Properties
• validate container SAS Read and List permissions, HTTPS-only protocol, account/container match, signed version/signature, validity window, account-SAS resource scope, and blob-SAS incompatibility
• warn when container/account SAS includes unnecessary Write, Create, Add, Delete, tag, move, ownership, or policy permissions; warn when account SAS/account keys are broader than one container needs
• show non-secret credential scope, named permissions, exact expiry, hours/days remaining, stored-policy status, IP restrictions, and warnings in connection tests and source rows
• log only safe Azure error code/status/request ID/scope diagnostics and return actionable permission, signature/expiry, IP/network, or container guidance
• validate new Blob credentials before secret writes, omit hidden local credentials for reusable identities, and refresh identity-backed metadata after rotation
• restrict SDK endpoints to canonical HTTPS Azure Blob hosts and keep detailed failures in sanitized server logs instead of client responses
• add admin/workspace UI, document badges, documentation, tests, release notes, and version 0.250.070

Validation

• python -m pytest functional_tests/test_file_sync_azure_blob_storage.py -q (21 passed)
• Azure Files and OneDrive File Sync regression suites passed
• route Blueprint policy inventory: 6 passed
• unauthenticated route policy contract: 4 passed
• route policy coverage: 2 passed
• Python compilation and editor diagnostics passed
• changed-line and full-file XSS guardrails passed
• changed-line and full-file broken-access-control guardrails passed
• committed whitespace check passed

UI Validation Note

The affected Playwright tests cover SAS URL autofill, container-derived source names, source-row permission/expiry metadata, and connection-test warnings. The source modal can hot-reload browser assets while a long-lived Flask worker still runs old Python, so the backend must be restarted on the latest commit before manual retesting.

Fixes #1027