Support multitenant Entra authentication

[dkhalife]

Summary

• allow an omitted Entra tenant setting to use the common authority
• support organizational and personal Microsoft accounts across API, web, Android, and MCP authentication
• document the app-registration requirements

Validation

• API build and test suite
• frontend lint, type check, production build, and tests
• Android unit tests and debug build
• MCP server build

[Copilot]

Pull request overview

This PR expands Task Wizard’s Microsoft Entra ID authentication support to work in a multi-tenant configuration (including personal Microsoft accounts) by making tenant_id optional and validating tenant-specific issuers at runtime across the API server, frontend, Android app, and MCP server.

Changes:

• Make Entra tenant restriction optional by defaulting authorities to common when tenant_id is empty/omitted.
• Add multi-tenant issuer validation logic in the API server and MCP server.
• Update frontend MSAL account-selection behavior and add tests; document updated Entra app registration requirements.

Show a summary per file

File	Description
README.md	Updates Entra setup instructions and config/env var docs for optional tenant ID and multi-tenant registrations.
mcpserver/Program.cs	Allows missing tenant ID (defaults to common) and adds custom issuer validation for multi-tenant tokens.
frontend/src/utils/msal.ts	Uses common authority when tenant is optional and adjusts active-account selection logic.
frontend/test/utils/msal.test.ts	Adds unit coverage for optional-tenant account selection behavior.
apiserver/internal/middleware/auth/auth.go	Builds default issuer from common when tenant is omitted and validates issuer per-tenant when in multi-tenant mode.
apiserver/internal/middleware/auth/auth_test.go	Adds tests for multi-tenant vs single-tenant issuer validation behavior.
apiserver/config/config.go	Adds AuthorityTenantID() helper to default tenant authority to common.
apiserver/config/config_test.go	Adds tests for AuthorityTenantID().
apiserver/config/config.yaml	Documents that omitting/empty tenant_id enables multi-tenant + personal accounts.
android/app/src/main/java/app/taskwiz/auth/AuthManager.kt	Selects appropriate MSAL audience type based on whether tenant is restricted or optional.
.agents/features/authentication.md	Updates feature documentation to describe optional tenant restriction and redirect URI requirements.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 4
• Review effort level: Lite