Wire Azure OCR to central settings toggle; remove redundant Users section

- settings/src/integrations/schema.js: rename azure from 'Azure AD' to
  'Azure Document Intelligence', swap fields to endpoint + api_key
- Add use_global_azure column (migration + model)
- global_settings_service: add azure to check_global_status and apply_global_overrides
- api/settings.py: expose use_global_azure in response/update; apply overrides
  in test_azure_connection before credential check
- Settings.tsx: add 'Use credentials from main stack settings' toggle for
  Azure OCR section (endpoint/key disabled when on, test button enabled when
  global is configured); remove Users section (managed centrally via auth
  service), clean up UserData interface, users query and mutations

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/settings.py

@@ -51,6 +51,7 @@ class SettingsResponse(BaseModel):
     llm_features_enabled: dict | None = None
     # Global stack settings delegation
     use_global_smtp: bool = False
+    use_global_azure: bool = False
 
     class Config:
         from_attributes = True
@@ -96,6 +97,7 @@ class SettingsUpdate(BaseModel):
     llm_features_enabled: dict | None = None
     # Global stack settings delegation
     use_global_smtp: bool | None = None
+    use_global_azure: bool | None = None
 
 
 @router.get("/", response_model=SettingsResponse)
@@ -163,6 +165,7 @@ def _build_settings_response(settings: KitchenSettings) -> SettingsResponse:
         llm_monthly_token_limit=settings.llm_monthly_token_limit,
         llm_features_enabled=settings.llm_features_enabled,
         use_global_smtp=settings.use_global_smtp,
+        use_global_azure=settings.use_global_azure,
     )
 
 
@@ -205,7 +208,13 @@ async def test_azure_connection(
     )
     settings = result.scalar_one_or_none()
 
-    if not settings or not settings.azure_endpoint or not settings.azure_key:
+    if not settings:
+        raise HTTPException(status_code=400, detail="Azure credentials not configured")
+
+    from services.global_settings_service import apply_global_overrides
+    await apply_global_overrides(settings)
+
+    if not settings.azure_endpoint or not settings.azure_key:
         raise HTTPException(
             status_code=400,
             detail="Azure credentials not configured"

backend/migrations/add_global_settings_flags.py

@@ -12,6 +12,7 @@ async def migrate():
             "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_newbook BOOLEAN DEFAULT FALSE",
             "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_resos BOOLEAN DEFAULT FALSE",
             "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_sambapos BOOLEAN DEFAULT FALSE",
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_azure BOOLEAN DEFAULT FALSE",
         ]:
             try:
                 await conn.execute(text(col))

backend/models/settings.py

@@ -220,6 +220,7 @@ class KitchenSettings(Base):
     use_global_newbook: Mapped[bool] = mapped_column(Boolean, default=False)
     use_global_resos: Mapped[bool] = mapped_column(Boolean, default=False)
     use_global_sambapos: Mapped[bool] = mapped_column(Boolean, default=False)
+    use_global_azure: Mapped[bool] = mapped_column(Boolean, default=False)
 
     # Internal API key (for in-house apps like menu display plugin)
     api_key: Mapped[str | None] = mapped_column(String(100), nullable=True)

backend/services/global_settings_service.py

@@ -43,6 +43,7 @@ async def check_global_status() -> dict[str, bool]:
         "newbook": ["api_key"],
         "resos": ["api_key"],
         "sambapos": ["password"],
+        "azure": ["api_key"],
     }
     results: dict[str, bool] = {}
     for slug, fields in required.items():
@@ -95,3 +96,9 @@ async def apply_global_overrides(settings) -> None:
             settings.sambapos_db_name = creds.get("database") or settings.sambapos_db_name
             settings.sambapos_db_username = creds.get("username") or settings.sambapos_db_username
             settings.sambapos_db_password = creds.get("password") or settings.sambapos_db_password
+
+    if getattr(settings, "use_global_azure", False):
+        creds = await get_global_integration("azure")
+        if creds:
+            settings.azure_endpoint = creds.get("endpoint") or settings.azure_endpoint
+            settings.azure_key = creds.get("api_key") or settings.azure_key