### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add keyless **Microsoft Entra ID / Azure Workload Identity** authentication for the proxy's PostgreSQL database, mirroring the existing AWS `IAM_TOKEN_DB_AUTH` path. The proxy would mint a short-lived Entra access token (scope `https://ossrdbms-aad.database.windows.net/.default`) via `azure-identity`'s `DefaultAzureCredential`, use it as the DB password, and let the **existing `PrismaWrapper` background-refresh / reconnect machinery** handle rotation — so no static DB password is needed on Azure.

Proposed, intentionally small and symmetric with the AWS path:

- New `litellm/proxy/auth/azure_entra_db_token.py` with `generate_azure_entra_db_token(db_host, db_user)`, mirroring `litellm/proxy/auth/rds_iam_token.py::generate_iam_auth_token`. - Select the token source in `PrismaWrapper.get_rds_iam_token()` / `litellm/proxy/db/db_url_settings.py` based on a provider — e.g. reuse the `IAM_TOKEN_DB_AUTH` activation plus a new `IAM_DB_AUTH_PROVIDER=aws|azure` (default `aws`, fully backward compatible). - Reuse the entire existing refresh/reconnect/lock wra…