Azure has two levels: the account maps to DNS (<account>.blob.core.windows.net)
and anonymous access is per container with no anonymous container enumeration.
Discovery now tests incoming labels as Azure account names (DNS existence) and,
for accounts that exist, probes a small set of common containers, indexing any
that list anonymously. CONTENT still never downloaded.
Also document that docker compose down -v wipes all discovered assets; use
stop/start to keep the pgdata volume.
Live: connectsystem.blob.core.windows.net indexed (33 objects).