fix: prepend bucket prefix to Azure SPN and SAS storage paths (#14185)

## Summary

Fixes #14159 — files from different datasets can overwrite each other in
Azure Blob storage.

## Problem

Both `azure_spn_conn.py` and `azure_sas_conn.py` ignore the `bucket`
parameter in all storage operations (`put`, `get`, `rm`, `obj_exist`,
`get_presigned_url`). Files are stored flat using only the filename, so
two datasets containing a file with the same name will overwrite each
other.

The MinIO and S3 implementations correctly use the bucket (typically the
knowledge base ID) as a path prefix to create logical folder isolation:
- MinIO: uses `use_prefix_path` decorator → `{orig_bucket}/{fnm}`
- S3: uses `use_prefix_path` decorator → `{prefix_path}/{bucket}/{fnm}`

## Fix

Prepend `{bucket}/` to the file path in all 5 operations across both
Azure connector files:

| File | Methods fixed |
|------|---------------|
| `azure_spn_conn.py` | `put`, `get`, `rm`, `obj_exist`,
`get_presigned_url` |
| `azure_sas_conn.py` | `put`, `get`, `rm`, `obj_exist`,
`get_presigned_url` |

This matches the existing convention where `bucket` is the knowledge
base ID used as a directory prefix.

## ⚠️ Migration Note

Existing Azure SPN/SAS deployments have files stored without the bucket
prefix. After this fix, new files will be stored under
`{bucket}/{filename}` while existing files remain at `{filename}`. A
one-time migration script or manual file move may be needed for existing
deployments. New deployments are unaffected.

## Testing

- Verified the fix is consistent across all 5 methods in both files
- The `health()` method is intentionally left unchanged as it uses a
hardcoded test filename without bucket semantics

Co-authored-by: Jin Hai <haijin.chn@gmail.com>

rag/utils/azure_sas_conn.py

@@ -52,11 +52,12 @@ class RAGFlowAzureSasBlob:
         return self.conn.upload_blob(name=fnm, data=BytesIO(binary), length=len(binary))
 
     def put(self, bucket, fnm, binary, tenant_id=None):
+        blob_name = f"{bucket}/{fnm}"
         for _ in range(3):
             try:
-                return self.conn.upload_blob(name=f"{bucket}/{fnm}", data=BytesIO(binary), length=len(binary))
+                return self.conn.upload_blob(name=blob_name, data=BytesIO(binary), length=len(binary))
             except Exception:
-                logging.exception(f"Fail put {bucket}/{fnm}")
+                logging.exception(f"Fail put {blob_name}")
                 self.__open__()
                 time.sleep(1)
 
@@ -67,12 +68,13 @@ class RAGFlowAzureSasBlob:
             logging.exception(f"Fail rm {bucket}/{fnm}")
 
     def get(self, bucket, fnm):
+        blob_name = f"{bucket}/{fnm}"
         for _ in range(1):
             try:
-                r = self.conn.download_blob(f"{bucket}/{fnm}")
+                r = self.conn.download_blob(blob_name)
                 return r.read()
             except Exception:
-                logging.exception(f"fail get {bucket}/{fnm}")
+                logging.exception(f"fail get {blob_name}")
                 self.__open__()
                 time.sleep(1)
         return
@@ -85,11 +87,12 @@ class RAGFlowAzureSasBlob:
         return False
 
     def get_presigned_url(self, bucket, fnm, expires):
+        blob_name = f"{bucket}/{fnm}"
         for _ in range(10):
             try:
-                return self.conn.get_presigned_url("GET", bucket, fnm, expires)
+                return self.conn.get_presigned_url("GET", bucket, blob_name, expires)
             except Exception:
-                logging.exception(f"fail get {bucket}/{fnm}")
+                logging.exception(f"fail get {blob_name}")
                 self.__open__()
                 time.sleep(1)
         return

rag/utils/azure_spn_conn.py

@@ -69,13 +69,14 @@ class RAGFlowAzureSpnBlob:
         return f.flush_data(len(binary))
 
     def put(self, bucket, fnm, binary, tenant_id=None):
+        blob = f"{bucket}/{fnm}"
         for _ in range(3):
             try:
-                f = self.conn.create_file(f"{bucket}/{fnm}")
+                f = self.conn.create_file(f"{blob}")
                 f.append_data(binary, offset=0, length=len(binary))
                 return f.flush_data(len(binary))
             except Exception:
-                logging.exception(f"Fail put {bucket}/{fnm}")
+                logging.exception(f"Fail put {blob}")
                 self.__open__()
                 time.sleep(1)
                 return None
@@ -88,13 +89,14 @@ class RAGFlowAzureSpnBlob:
             logging.exception(f"Fail rm {bucket}/{fnm}")
 
     def get(self, bucket, fnm):
+        blob = f"{bucket}/{fnm}"
         for _ in range(1):
             try:
-                client = self.conn.get_file_client(f"{bucket}/{fnm}")
+                client = self.conn.get_file_client(f"{blob}")
                 r = client.download_file()
                 return r.read()
             except Exception:
-                logging.exception(f"fail get {bucket}/{fnm}")
+                logging.exception(f"fail get {blob}")
                 self.__open__()
                 time.sleep(1)
         return None
@@ -108,9 +110,10 @@ class RAGFlowAzureSpnBlob:
         return False
 
     def get_presigned_url(self, bucket, fnm, expires):
+        f_path = f"{bucket}/{fnm}"
         for _ in range(10):
             try:
-                return self.conn.get_presigned_url("GET", bucket, fnm, expires)
+                return self.conn.get_presigned_url("GET", bucket, f_path, expires)
             except Exception:
                 logging.exception(f"fail get {bucket}/{fnm}")
                 self.__open__()