Make Foundry auth overrides replace inherited auth

[sylvesterkaczmarek]

Summary

Make Foundry copy() / with_options() auth overrides replace the inherited authentication method instead of silently keeping both credentials.

The current copy implementation resolves auth with truthy fallbacks:

api_key=api_key or self.api_key

azure_ad_token_provider=azure_ad_token_provider or self._azure_ad_token_provider

That means an explicit auth switch does not actually clear the previous method. For example, copying an Azure-AD-authenticated client with api_key="new-key" retains the inherited token provider, so the explicit API key is not actually used as the clone's auth method.

Fix

Treat Foundry authentication as one mutually exclusive choice in both sync and async clients:

• reject explicitly supplying both auth methods;
• only resolve ANTHROPIC_FOUNDRY_API_KEY when no Azure AD provider was supplied;
• clear first-party auth state inherited through the base client;
• API-key overrides clear the inherited Azure AD provider;
• Azure AD overrides clear the inherited API key;
• no override preserves the current Foundry auth method.

Regression coverage

Adds sync and async tests for both auth transitions, verifies the actual prepared headers, rejects two explicit auth methods, and verifies an ambient ANTHROPIC_API_KEY does not pollute Azure AD Foundry auth state.

The production change is confined to the hand-maintained Foundry client.