feat: Azure AD single-tenant support + system requirements

- Add Azure AD Tenant provider for organizations that want to restrict
  login to a specific Entra ID tenant (vs allowing any Microsoft account)
- Add system requirements documentation (RAM, CPU, disk) for Docker builds
- Addresses issue where frontend build fails on memory-constrained systems

Closes #120, closes #132

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tabby/app/api/auth.py

@@ -31,6 +31,12 @@ PROVIDER_CONFIG = {
         'cls': 'btn-light',
         'env_prefix': 'SOCIAL_AUTH_MICROSOFT_GRAPH',
     },
+    'azuread-tenant-oauth2': {
+        'name': 'Azure AD',
+        'icon': 'microsoft',
+        'cls': 'btn-light',
+        'env_prefix': 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2',
+    },
     'auth0': {
         'name': 'Auth0',
         'icon': 'key',  # Using key icon as Auth0 doesn't have a FA brand icon
@@ -58,6 +64,10 @@ def is_provider_configured(env_prefix: str) -> bool:
     if env_prefix == 'SOCIAL_AUTH_OIDC':
         endpoint = getattr(settings, f'{env_prefix}_OIDC_ENDPOINT', None)
         return bool(key and secret and endpoint)
+    # For Azure AD Tenant (single-tenant), also need TENANT_ID
+    if env_prefix == 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2':
+        tenant_id = getattr(settings, f'{env_prefix}_TENANT_ID', None)
+        return bool(key and secret and tenant_id)
     return bool(key and secret)