feat: Azure AD single-tenant support + system requirements

- Add Azure AD Tenant provider for organizations that want to restrict
  login to a specific Entra ID tenant (vs allowing any Microsoft account)
- Add system requirements documentation (RAM, CPU, disk) for Docker builds
- Addresses issue where frontend build fails on memory-constrained systems

Closes #120, closes #132

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tabby/app/api/auth.py

@@ -31,6 +31,12 @@ PROVIDER_CONFIG = {
         'cls': 'btn-light',
         'env_prefix': 'SOCIAL_AUTH_MICROSOFT_GRAPH',
     },
+    'azuread-tenant-oauth2': {
+        'name': 'Azure AD',
+        'icon': 'microsoft',
+        'cls': 'btn-light',
+        'env_prefix': 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2',
+    },
     'auth0': {
         'name': 'Auth0',
         'icon': 'key',  # Using key icon as Auth0 doesn't have a FA brand icon
@@ -58,6 +64,10 @@ def is_provider_configured(env_prefix: str) -> bool:
     if env_prefix == 'SOCIAL_AUTH_OIDC':
         endpoint = getattr(settings, f'{env_prefix}_OIDC_ENDPOINT', None)
         return bool(key and secret and endpoint)
+    # For Azure AD Tenant (single-tenant), also need TENANT_ID
+    if env_prefix == 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2':
+        tenant_id = getattr(settings, f'{env_prefix}_TENANT_ID', None)
+        return bool(key and secret and tenant_id)
     return bool(key and secret)
 
 

backend/tabby/settings.py

@@ -138,6 +138,7 @@ AUTHENTICATION_BACKENDS = (
     "social_core.backends.github.GithubOAuth2",
     "social_core.backends.gitlab.GitLabOAuth2",
     "social_core.backends.azuread.AzureADOAuth2",
+    "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
     "social_core.backends.microsoft.MicrosoftOAuth2",
     "social_core.backends.google.GoogleOAuth2",
     "social_core.backends.auth0.Auth0OAuth2",
@@ -193,6 +194,9 @@ for key in [
     "SOCIAL_AUTH_OIDC_KEY",
     "SOCIAL_AUTH_OIDC_SECRET",
     "SOCIAL_AUTH_OIDC_NAME",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID",
     "CONNECTION_GATEWAY_AUTH_CA",
     "CONNECTION_GATEWAY_AUTH_CERTIFICATE",
     "CONNECTION_GATEWAY_AUTH_KEY",