fix: gate Teams media auth retries

src/config/types.msteams.ts

@@ -83,6 +83,11 @@ export type MSTeamsConfig = {
    * Use ["*"] to allow any host (not recommended).
    */
   mediaAllowHosts?: Array<string>;
+  /**
+   * Allowed host suffixes for attaching Authorization headers to inbound media retries.
+   * Use specific hosts only; avoid multi-tenant suffixes.
+   */
+  mediaAuthAllowHosts?: Array<string>;
   /** Default: require @mention to respond in channels/groups. */
   requireMention?: boolean;
   /** Max group/channel messages to keep as history context (0 disables). */

src/config/zod-schema.providers-core.ts

@@ -800,6 +800,7 @@ export const MSTeamsConfigSchema = z
     chunkMode: z.enum(["length", "newline"]).optional(),
     blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
     mediaAllowHosts: z.array(z.string()).optional(),
+    mediaAuthAllowHosts: z.array(z.string()).optional(),
     requireMention: z.boolean().optional(),
     historyLimit: z.number().int().min(0).optional(),
     dmHistoryLimit: z.number().int().min(0).optional(),