Out of desperation I tried switching to the Microsoft ODBC drivers instead of FreeTDS. And somehow, that works.

I have no idea why, as it's clearly something about the Azure environment, since FreeTDS absolutely works when using an ssh tunnel to forward the connection through some external host. But the Microsoft ODBC driver apparently knows the secret sauce Azure wants.