FIX: Reconcile explicit auth_mode with the get_auth_mode_parameters hook

PR #2846 landed the AzureBlobStorageTarget half of this bug using a
get_auth_mode_parameters classmethod. Adopt that hook as the single
mechanism for carrying auth intent into target construction and drop the
_accepts_auth_mode signature introspection, which only existed because
AzureBlobStorageTarget lacked the parameter.

Every target advertising identity support now overrides the hook, guarded
by a registry-wide contract test so a future identity target cannot
silently fall back to inferring auth from a missing key.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Copilot

doc/code/setup/1_configuration.ipynb

@@ -212,7 +212,7 @@
     ")\n",
     "```\n",
     "\n",
-    "`auth_mode` defaults to `\"api_key\"`, which preserves the resolution order above. It is supported by the OpenAI targets, `AzureMLChatTarget`, and `PromptShieldTarget`."
+    "On the OpenAI targets, `AzureMLChatTarget`, and `PromptShieldTarget`, `auth_mode` defaults to `\"api_key\"`, which preserves the resolution order above. `AzureBlobStorageTarget` accepts the same `auth_mode=\"identity\"` to bypass its SAS token sources; it defaults to selecting a credential automatically."
    ]
   },
   {

doc/code/setup/1_configuration.py

@@ -122,7 +122,7 @@
 # )
 # ```
 #
-# `auth_mode` defaults to `"api_key"`, which preserves the resolution order above. It is supported by the OpenAI targets, `AzureMLChatTarget`, and `PromptShieldTarget`.
+# On the OpenAI targets, `AzureMLChatTarget`, and `PromptShieldTarget`, `auth_mode` defaults to `"api_key"`, which preserves the resolution order above. `AzureBlobStorageTarget` accepts the same `auth_mode="identity"` to bypass its SAS token sources; it defaults to selecting a credential automatically.
 
 # %% [markdown]
 # ## Choosing a database

tests/unit/registry/test_target_registry.py

@@ -446,3 +446,15 @@ def test_credential_parameters_are_sensitive(self, registry: TargetRegistry) ->
                 )
                 if looks_like_credential:
                     assert parameter.sensitive, f"{name}.{parameter.name} looks like a credential"
+
+    def test_identity_targets_accept_an_explicit_auth_mode(self, registry: TargetRegistry) -> None:
+        # Advertising identity support without accepting the explicit mode would silently
+        # fall back to inferring auth from a missing key, which is the ambiguity the
+        # explicit auth_mode contract exists to remove.
+        for name in registry.get_class_names():
+            target_cls = registry.get_class(name)
+            if "identity" not in target_cls.supported_auth_modes:
+                continue
+            assert target_cls.get_auth_mode_parameters(auth_mode="identity") == {"auth_mode": "identity"}, (
+                f"{name} advertises identity support but does not forward an explicit auth_mode"
+            )