Wire Azure OCR to central settings toggle; remove redundant Users section

- settings/src/integrations/schema.js: rename azure from 'Azure AD' to
  'Azure Document Intelligence', swap fields to endpoint + api_key
- Add use_global_azure column (migration + model)
- global_settings_service: add azure to check_global_status and apply_global_overrides
- api/settings.py: expose use_global_azure in response/update; apply overrides
  in test_azure_connection before credential check
- Settings.tsx: add 'Use credentials from main stack settings' toggle for
  Azure OCR section (endpoint/key disabled when on, test button enabled when
  global is configured); remove Users section (managed centrally via auth
  service), clean up UserData interface, users query and mutations

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/settings.py

@@ -51,6 +51,7 @@ class SettingsResponse(BaseModel):
     llm_features_enabled: dict | None = None
     # Global stack settings delegation
     use_global_smtp: bool = False
+    use_global_azure: bool = False
 
     class Config:
         from_attributes = True
@@ -96,6 +97,7 @@ class SettingsUpdate(BaseModel):
     llm_features_enabled: dict | None = None
     # Global stack settings delegation
     use_global_smtp: bool | None = None
+    use_global_azure: bool | None = None
 
 
 @router.get("/", response_model=SettingsResponse)
@@ -163,6 +165,7 @@ def _build_settings_response(settings: KitchenSettings) -> SettingsResponse:
         llm_monthly_token_limit=settings.llm_monthly_token_limit,
         llm_features_enabled=settings.llm_features_enabled,
         use_global_smtp=settings.use_global_smtp,
+        use_global_azure=settings.use_global_azure,
     )
 
 
@@ -205,7 +208,13 @@ async def test_azure_connection(
     )
     settings = result.scalar_one_or_none()
 
-    if not settings or not settings.azure_endpoint or not settings.azure_key:
+    if not settings:
+        raise HTTPException(status_code=400, detail="Azure credentials not configured")
+
+    from services.global_settings_service import apply_global_overrides
+    await apply_global_overrides(settings)
+
+    if not settings.azure_endpoint or not settings.azure_key:
         raise HTTPException(
             status_code=400,
             detail="Azure credentials not configured"