docs(prd): amend Entra PRD with Directory abstraction + multi-provider scope

[larsgeorge-db]

Companion doc PR for the Directory stack (#406 / #407 / #412 / #413 / #416 / #417). The plan (#375) called for this amendment as a follow-up so the PRD reflects what shipped without rewriting story content.

Summary

• Renames the integration's manager / routes / settings keys in docs/prds/prd-entra-id-graph-integration.md to match the implementation: Directory layer, `/api/directory/`, `DIRECTORY_` settings, "Directory" tab under Integrations. The original "Entra integration" naming stays in the PRD body for historical context and is mapped in the amendment table.
• Documents the `DirectoryProvider` ABC and the `(DirectoryProviderContext, DirectoryProviderConfig)` factory signature, so a future Okta / Ping / SCIM contributor knows the contract.
• Documents the v1 provider set, which expanded during planning from Entra-only to entra + lakebase + file:
  • `entra` — Microsoft Graph via UC HTTP Connection (the original PRD scope).
  • `lakebase` — Postgres / Lakebase table, schema documented.
  • `file` — local CSV, format documented.
• Surfaces the Lakebase required SQL schema and the File CSV format inline so operators have a single setup reference.
• Re-confirms what's still out of scope (Okta/Ping, service principals, OBO, profile photos, manager hierarchy, role/team Select replacement, CSV bulk import) — the abstraction is the thing that turns the first three from "ten-file changes" into "register one factory".

What's intentionally preserved verbatim

• Every user story (1–31) in the PRD body.
• The disambiguation rule, both picker modes, tooltip / X-remove / two-line-row guarantees.
• Storage-compatibility ("`string` / `List[str]`, no DB migration").
• Graceful degradation: a failing search drops the picker into manual-entry mode for the rest of the session.
• The full "Out of Scope" list.

What's not in this PR

• No code changes. This is purely the documentation amendment the plan docs(plan): directory lookup and principal picker plan #375 called out as an out-of-band follow-up.

Test plan

• Markdown renders.
• All cross-links (`plans/directory-lookup-and-principal-picker.md`) resolve.
• Provider table matches the registry in `directory_manager.py` from feat(directory): Phase 1 backend — Directory layer + Entra provider #406 + feat(directory): add Lakebase + File providers #416.
• Lakebase SQL snippet matches the validation rules in `lakebase_provider.py` from feat(directory): add Lakebase + File providers #416.
• CSV snippet matches the parser in `file_provider.py` from feat(directory): add Lakebase + File providers #416.