Selects exactly one active auth strategy per deployment, chosen via the
auth_method config value — there is no runtime engine for resolving
multiple simultaneously-required schemes. These three methods
(SqlServer/Windows/AzureAd) are the complete set SQL Server’s TDS
protocol accepts (see core::config_schema::AuthMethod’s doc comment)
— there is no per-request/HTTP-header credential relay concept here:
this server always connects to SQL Server with the one set of
operator-configured credentials resolved via credentials()’s config/
env/keychain cascade below, regardless of how a caller reaches this
MCP server (stdio or HTTP).