Test coverage for resolveMSTeamsCredentials and hasConfiguredMSTeamsCredentials
across all three auth types introduced in the preceding commit. Fixed existing
test expectation to include authType field in resolved credentials result.
Verifies certificate auth requires both cert files, federated auth requires
ficClientId or widAssertionFile, and clientSecret is the default authType.

Variable appPassword in MSTeamsCredentials (token.ts) was declared as
required but set to empty string for certificate and federated credential
auth paths. Changed to optional to accurately represent the type contract.
Guarded clientSecret assignment in sdk.ts to handle undefined appPassword.
Added test assertions verifying appPassword is undefined for certificate
and federated credential auth.

Type MSTeamsAuthType in token.ts was a standalone union duplicating the
inline type in MSTeamsConfig.authType (types.msteams.ts). Replaced with
NonNullable<MSTeamsConfig["authType"]> to maintain a single source of
truth. Adding a new auth method now only requires updating types.msteams.ts.

Fields authType, certPemFile, certKeyFile, sendX5C, ficClientId, and
widAssertionFile were added to MSTeamsConfig (types.msteams.ts) but not
to MSTeamsConfigSchema (zod-schema.providers-core.ts). The strict Zod
schema rejected configs using these fields as unrecognized properties.
Added cross-field validation in superRefine: authType "certificate"
requires certPemFile and certKeyFile, authType "federatedCredential"
requires ficClientId or widAssertionFile.

Error messages in errors.ts and probe.ts dropped references to environment
variables MSTEAMS_APP_ID and MSTEAMS_TENANT_ID when the new auth types were
added. Restored env var hints alongside the new auth type guidance so users
configuring via environment variables still get actionable error messages.
Added test assertions verifying env var names appear in auth error hint.

Added presence helpers that check certificate and federated credential
auth material across typed config, SDK plain env vars (certPemFile,
certKeyFile, FICClientId, WIDAssertionFile), and SDK connection env
vars (connections__*__settings__*). Credential resolution and
hasConfiguredMSTeamsCredentials now reject empty configs that have no
auth material in any source, preventing silent fallthrough to managed
identity auth in the SDK. Configs backed by SDK env vars are accepted.

Aligned certificate case in buildMSTeamsAuthConfig with federated case —
only assign certPemFile/certKeyFile to base when present, so undefined
values do not shadow the SDK's env var resolution. Added explicit test
assertions documenting that env-only cert paths are not forwarded in
credentials (SDK merges them at runtime).

New authType "defaultAzureCredential" defers credential selection to
@azure/identity's DefaultAzureCredential, which tries environment
variables, workload identity, managed identity, az cli, and other
sources automatically. Enables passwordless Teams auth in AKS via
workload identity without explicit certificate or secret management.

Added DefaultAzureCredentialTokenProvider in sdk.ts as a drop-in
replacement for MsalTokenProvider. Added createTokenProvider() factory
that returns the appropriate provider based on authType. Updated all
4 call sites (probe, monitor, send-context, graph) to use the factory.

Added @azure/identity as a dependency of the msteams extension.

CloudAdapter.process() acquires outbound tokens via MsalTokenProvider,
which has its own credential chain (WID → FIC → secret → cert → MI).
With defaultAzureCredential, none of these fields were set, causing
fallthrough to ManagedIdentityApplication — which does not support
AKS workload identity federation.

Detect AZURE_FEDERATED_TOKEN_FILE (injected by the workload identity
webhook) and pass it as WIDAssertionFile so the SDK uses its native
WID path. Falls back to @azure/identity DefaultAzureCredential for
environments without workload identity.