Login as service principal az

Non-interactive auth for CI; modern: use --federated-token for OIDC, no secret

az login --service-principal -u <id> -p "$AZ_SECRET" --tenant <id>