fix(sleep): harden OpenAI compatibility boundaries

[Yif-Yang]

Summary

• require HTTPS as well as an allowed Azure hostname before constructing the managed-identity client
• send SKILLOPT_SLEEP_CHAT_EXTRA_BODY only in explicit OpenAI-compatible mode
• add regression tests for plaintext Azure endpoints and native-Azure request isolation

This is a narrow maintainer follow-up to #129. We merged the contributor's feature first so its authorship and contribution history remain intact, then added these two defense-in-depth fixes separately.

Tests

• pytest tests/test_azure_openai_compat.py -q — 19 passed
• pytest tests/ -q — 296 passed, 6 skipped
• git diff --check