Add lstk az Azure CLI integration via LocalStack proxy

[carole-lavillonniere]

Motivation

Bring Azure CLI integration into lstk so users can run az commands against the LocalStack Azure emulator. Following the team discussion, this uses the proxy/wrap model (azlocal's wrap mode), not start-interception global mutation — it mirrors lstk aws and leaves the user's global ~/.azure untouched.

Approach

The Azure CLI has no --endpoint-url/--profile; the only isolation knob is AZURE_CONFIG_DIR. So:

• lstk setup azure prepares an isolated config dir (<lstk-config-dir>/azure/): discovers LocalStack's proxy via /_localstack/proxy, caches the LocalStack CA (appended to the system trust store), disables Azure CLI telemetry, and does a one-time dummy service-principal login routed through the proxy.
• lstk az <args> runs az <args> with AZURE_CONFIG_DIR + HTTP(S)_PROXY (LocalStack proxy) + REQUESTS_CA_BUNDLE/SSL_CERT_FILE (cached CA). Because all traffic is proxied, no per-service endpoint registration is needed — new emulator services work without CLI changes.

Changes

• internal/azurecli — wraps the az binary, injecting extra env (config dir, proxy, CA) without touching the global environment.
• internal/azureconfig — proxy discovery, CA caching, ProxyEnv builder, IsSetUp marker, and the Setup flow. (Dropped the earlier global cloud register/set/instance_discovery code.)
• cmd/az.go — new lstk az command. Uses an HTTP health probe (not Docker container resolution, since Azure isn't in knownImages) to check the emulator is up, and errors with a pointer to lstk setup azure if integration isn't prepared.
• cmd/setup.go — lstk setup azure reworked to the isolated-dir prep; no longer requires an interactive terminal (the SP login is non-interactive).
• lstk az / lstk setup azure mirror lstk aws's default-container fallback (port 4566) — no config.toml edit required.

Tests

• Unit: BuildEndpoint, ConfigDir, ProxyEnv, ProxyEndpoint parsing, cacheCACert + IsSetUp, and IsRunning against an httptest server.
• Integration: lstk az errors with a setup hint when the isolated dir isn't prepared (deterministic, no Docker).
• Manual happy path (needs az + localstack/localstack-azure-alpha) still pending — lstk setup azure then lstk az group list should hit LocalStack while plain az group list hits real Azure.

Todo

• Verify happy path end-to-end against the alpha Azure image (CA bundling + proxy routing).
• Wire Azure into knownImages/emulatorHealthPaths/ContainerPort so lstk start can launch the Azure emulator (separate ticket).

Closes FLC-656