[Refactor] Collapse Microsoft setup dual-write to single ownership

[roomote-roomote-v1]

Created by Roomote. Follow up by mentioning @openmote or in the web UI.

What changed

Microsoft Teams setup now stores only the Microsoft sign-in credentials for the single-app path. Dedicated Teams bot env vars are no longer copied client-side on save; setup treats them as optional dual-app overrides, and the bot continues to fall back to the Microsoft app values at runtime.

Why this change was made

Runtime already reuses Microsoft sign-in credentials when no dedicated bot pair is configured. Dual-writing a second ownership layer during setup made setup harder to reason about and stored redundant secrets without adding capability.

Impact

Operators finishing Microsoft setup only save one app registration. Existing installations with dedicated bot credentials keep working, and Settings or env vars can still set optional bot overrides when a deployment intentionally uses a separate bot app.

[roomote-roomote-v1]

2 issues outstanding. See task

• apps/web/src/app/(onboarding)/setup/ProviderSetupExperience.tsx:63 Legacy setup-created TEAMS_BOT_* deployment env vars are never cleared now that setup submits only the visible ROOMOTE_AUTH_MICROSOFT_* values. Since resolveTeamsBotRuntimeCredentials still prefers a complete TEAMS_BOT_* pair, an upgrader who reruns setup to rotate the Microsoft app can leave the Teams bot using the stale copied secret/app ID instead of the newly saved Microsoft values.
• apps/docs/providers/communications/microsoft-teams.mdx:97 The manual Teams manifest guidance still tells the single-app path to use TEAMS_BOT_APP_ID, but this PR's default setup path no longer sets that env var. Reword it to use the Microsoft Client ID by default and TEAMS_BOT_APP_ID only for dedicated bot overrides.