azure key vault as a secret provider (bulk pull or inline azurekv:// references)

src/routes/settings/secrets/ProviderModal.svelte

@@ -29,6 +29,7 @@
 		{ value: 'doppler', label: 'Doppler' },
 		{ value: 'bitwarden', label: 'Bitwarden Secrets Manager' },
 		{ value: 'proton', label: 'Proton Pass' },
+		{ value: 'azure-kv', label: 'Azure Key Vault' },
 	];
 
 	// Config fields per provider type, matching the config shapes in
@@ -71,6 +72,12 @@
 		proton: [
 			{ key: 'token', label: 'Personal access token', type: 'password', required: true, placeholder: 'pst_...::...', hint: 'A Proton Pass personal access token (pst_...) used by the operator-installed pass-cli.' },
 		],
+		'azure-kv': [
+			{ key: 'vaultUri', label: 'Vault URI', type: 'text', required: true, placeholder: 'https://my-vault.vault.azure.net', hint: 'The Key Vault URI (from the vault Overview page).' },
+			{ key: 'tenantId', label: 'Tenant ID', type: 'text', required: true, placeholder: 'directory (tenant) ID', hint: 'Azure AD tenant (directory) ID of the app registration.' },
+			{ key: 'clientId', label: 'Client ID', type: 'text', required: true, placeholder: 'application (client) ID', hint: 'The service-principal (app registration) client ID.' },
+			{ key: 'clientSecret', label: 'Client secret', type: 'password', required: true, placeholder: 'app registration client secret', hint: 'A client secret for the app registration, with Get/List secret permission on the vault.' },
+		],
 	};
 
 	export function providerTypeLabel(type: string): string {
@@ -107,6 +114,11 @@
 			label: 'Vault',
 			placeholder: 'Proton Pass vault name',
 			hint: 'Bulk-load every item from this Proton Pass vault. Leave blank to inject only inline pass:// references.'
+		},
+		'azure-kv': {
+			label: 'Key Vault',
+			placeholder: 'any value enables bulk pull',
+			hint: 'Bulk-load every secret in the vault. Set any value to enable it; leave blank to inject only inline azurekv:// references.'
 		}
 	};
 </script>