Azure AAD: no production-grade token endpoint override (blocks live e2e against mock)

[moonming]

Bug — same class as #390/#391

`crates/aisix-provider-azure-openai/src/aad_token_mint.rs:140-160` declares `token_endpoint_override: Option` BUT both the field and its setter `with_token_endpoint_override` are `#[cfg(test)]` only. Production builds always POST to the hardcoded:

```
https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
```

An operator deploying behind a corporate proxy, on Azure Government cloud (`login.microsoftonline.us`), Azure China (`login.partner.microsoftonline.cn`), or pointing at a mock for e2e cannot redirect AAD token minting.

Customer impact

1. Azure Government / Azure China customers blocked — they use entirely different AAD endpoints (`.us` / `.cn` suffixes). The bridge hardcodes `.com`.
2. AISIX-Cloud AAD live e2e blocked — `adapter-azure-live.spec.ts` currently only exercises the api-key path because mock-llm has no way to receive AAD client_credentials requests.

Compare to peers

• Vertex bridge — production override works via the SA JSON's `token_uri` field (industry-standard GCP SA shape). `crates/aisix-provider-vertex/src/token_mint.rs:269` uses `sa.token_uri.clone()` in production.
• Bedrock bridge — `endpoint_url` from `ProviderKey.api_base` flows to the AWS SDK in production (fixed via fix(platform-adapters): honor ProviderKey.api_base in Vertex + Azure bridges (#390, #391) #392).
• Azure bridge — this gap.

Suggested fix

Add an optional `aad_token_endpoint` field to the AAD secret JSON:

```json
{
"tenant_id": "abc-123",
"client_id": "...",
"client_secret": "...",
"aad_token_endpoint": "https://login.microsoftonline.us/abc-123/oauth2/v2.0/token"
}
```

Default: derive from `tenant_id` against `login.microsoftonline.com` (current behavior).

Implementation:

1. Add `pub aad_token_endpoint: Option` to `AadCredentials` struct
2. In `resolve_token_endpoint`, prefer `creds.aad_token_endpoint` over the hardcoded URL
3. Add scheme/userinfo/query/fragment defensive checks (mirror `api_base` validation pattern from fix(platform-adapters): honor ProviderKey.api_base in Vertex + Azure bridges (#390, #391) #392)
4. Cap impact: when set, the URL is used verbatim; `tenant_id` is no longer interpolated (operator pasted the full path)

~30-50 LOC change + tests + docs note. Surface area: one new optional JSON field, fully backward compatible.

Blocks

• AISIX-Cloud P1 feat(etcd): ConfigProvider trait + watch supervisor #4 (AAD + SA-OAuth live spec) — Vertex half can ship via SA's existing `token_uri` mechanism; Azure half waits on this.
• Future Azure Government / Azure China customer support.

Surfaced via

P1 #4 of #302 follow-up audit (AISIX-Cloud), discovered during scoping of mock-llm `/{tenant}/oauth2/v2.0/token` endpoint addition.

[coderabbitai]

🔗 Related PRs

#355 - fix(proxy): use UUID request IDs across handlers [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!