Link the Entra ids on a PC to the Azure portal

The Entra Device Info card showed two GUIDs and nothing to do with them.
Copying one into the portal by hand is the kind of errand a detail page exists
to remove.

Each link sits BESIDE the id it is built from rather than in a row at the top
of the card, because the pairing is counterintuitive: the DEVICE id opens
Intune and the OBJECT id opens Entra. A separate action row would have to
re-label which is which, and would still leave the reader matching them up.

BOTH URLS ARE SETTINGS WITH AN EMPTY DEFAULT, and that is the whole design.
The host is a tenant fact, not a product one - this site is on the US
Government cloud, portal.azure.us, where a commercial-cloud default would send
people to a page that does not exist. Microsoft also moves these blade paths,
and a site that hits that can fix it by editing a setting rather than waiting
for a release. Empty means no link and the id still renders as text, so a site
that configures nothing is unchanged. The example values live in each
setting's description, per cloud.

Same shape as the ServiceNow URL templates already in integrations, down to
the {token} placeholder, so there is one idiom for "deep link into a system we
do not own" rather than two.

Scope: product

frontend/src/utils/siteSettings.js

@@ -115,6 +115,21 @@ export async function getServicenowUrls() {
   return { enabled, incidentUrl, changeUrl, searchUrl }
 }
 
+// Deep links into the Azure portal for a device ShopDB knows the Entra ids of.
+//
+// Both are TEMPLATES held in settings rather than built here, because the host
+// is a tenant fact: this site is on the US Government cloud (portal.azure.us)
+// and the commercial cloud is portal.azure.com. Microsoft also moves these
+// blade paths from time to time, and a site can fix that itself by editing a
+// setting instead of waiting for a release.
+//
+// Empty is the default and means "no link" - the id still renders as text.
+export async function getEntraDeviceUrls() {
+  const entraUrl = await getSetting('entra_device_url', '')
+  const intuneUrl = await getSetting('intune_device_url', '')
+  return { entraUrl, intuneUrl }
+}
+
 // Printer hostname template. {ip} is replaced with the dash-separated IP.
 export async function getPrinterHostnameTemplate() {
   return getSetting('printer_hostname_template', 'Printer-{ip}.printer.geaerospace.net')  // ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.