Move Microsoft signin secret into UI

Microsoft Signin's secret still lives in AWS instead of in a console credential like the other three, which breaks the "operate only through the UI" rule. Implement it, so that Microsoft signin and Azure Develop both work via operator configured credential (already exists but maybe need to be renamed to Microsoft). Operator will provide a credential after everything is deployed to main, so only automated tests.

Microsoft sign-in now uses the operator's Entra app credential (shared with Azure DevOps Connect, relabelled Microsoft) plus an off-by-default switch; env/AWS wiring removed. Quick gate + 689 tests green, review lanes pass. PR #6519 queued. Operator: designate app + turn on switch.