discover Azure Blob containers by account name

Azure has two levels: the account maps to DNS (<account>.blob.core.windows.net)
and anonymous access is per container with no anonymous container enumeration.
Discovery now tests incoming labels as Azure account names (DNS existence) and,
for accounts that exist, probes a small set of common containers, indexing any
that list anonymously. CONTENT still never downloaded.

Also document that docker compose down -v wipes all discovered assets; use
stop/start to keep the pgdata volume.

Live: connectsystem.blob.core.windows.net indexed (33 objects).

internal/discover/discover_test.go

@@ -17,6 +17,19 @@ func TestCandidatesAreExactLabelsOnly(t *testing.T) {
 	}
 }
 
+func TestValidAzureAccount(t *testing.T) {
+	for _, ok := range []string{"myaccount", "abc123", "a1b2c3d4e5f6g7h8i9j0k1l2"} {
+		if !validAzureAccount(ok) {
+			t.Fatalf("%q should be a valid Azure account name", ok)
+		}
+	}
+	for _, bad := range []string{"ab", "has-hyphen", "UPPER", "with.dot", "a1b2c3d4e5f6g7h8i9j0k1l2m3"} {
+		if validAzureAccount(bad) {
+			t.Fatalf("%q should be rejected as an Azure account name", bad)
+		}
+	}
+}
+
 func TestBaseLabelsSkipsNoise(t *testing.T) {
 	got := baseLabels("www.example.com")
 	if len(got) != 1 || got[0] != "example" {