CosmosStore with Entra-only auth (disableLocalAuth), string partition keys, AES-GCM encrypted configs. Containers: users, connections, run-requests, results.\n\nPart of #168