The device-code flow no longer uses the hardcoded Azure CLI client ID, which Microsoft now blocks as a first-party app. It now reads AZURE_AD_CLIENT_ID/AZURE_CLIENT_ID/MICROSOFT_CLIENT_ID and the tenant from env or app-config.json. Also disables the Connect Microsoft button when not configured and documents Azure AD registration.
