How Topaz enables az login without root: MSAL, port 443, and a built-in CONNECT proxy (opens in new tab)

Topaz cannot bind port 443 without root on non-Docker installs. MSAL's user-realm discovery pre-flight always targets port 443, which breaks ROPC login. This post explains the constraint, why the naive solutions do not work, and how a built-in HTTP CONNECT proxy solves it.