### What happened?

The Azure OpenAI **realtime** websocket path only ever sends an `api-key` header, so Azure deployments that authenticate with **Azure AD / Entra ID (managed identity, service principal, OIDC, etc.)** and have **no static API key** cannot connect to the realtime endpoint.

This affects real deployments such as `gpt-realtime-whisper` on Azure AI Foundry that are secured with Entra ID only.

**Affected code (current `litellm_internal_staging`):**

- `litellm/realtime_api/main.py` — the `azure` branch of `_arealtime` hard-codes `azure_ad_token=None` when calling `azure_realtime.async_realtime(...)`, so a token is never resolved or forwarded. - `litellm/llms/azure/realtime/handler.py` — `AzureOpenAIRealtime.async_realtime` always connects with `additional_headers={"api-key": api_key}`; there is no bearer-token path. - `litellm/realtime_api/main.py` — `_realtime_health_check` similarly always sends `api-key`, so an Entra ID-only deployment also fails its realtime health check.

By contrast, the non-realtime Azure flows already support AD tokens via `get_azure_ad_token(...)` and `BaseAzureLLM._base_validate_azure_environment` (which prefers `api-key`, then falls back t…