refactor(env): rename cloud 'dev' tier → 'ci'; promote 'local' to first-class tier

[mghabin]

Why

The auto-deployed first cloud tier was named dev, which conflated
two things:

1. The tier where developer-machine work happens (a laptop, no
   Azure resources, dotnet run).
2. The tier where CI auto-deploys every push to `main` without a
   human gate (an Azure RG, real cloud APIs, public ingress).

Calling them both "dev" hid what was actually running where. The honest
name for #2 is `ci` (built and deployed by CI, no human gate),
and #1 is its own first-class tier called `local` (no Azure, no
GH Environment, configured via `appsettings.Development.json` +
`dotnet user-secrets`).

Final ladder: `local → ci → ppe → prod`. `ppe` (Microsoft jargon
for "pre-production environment", analogous to "staging" elsewhere)
is unchanged.

What this PR does

Phase A — codebase rename (commit `dbd6537`):

• `infra/bicep/{azure,main,bootstrap}.dev.bicepparam` → `.ci.bicepparam`
• `@allowed([ 'dev', 'ppe', 'prod' ])` → `@allowed([ 'ci', 'ppe', 'prod' ])` in main/azure/bootstrap.bicep
• `devPublicClients` var → `ciPublicClients` (gated on `environmentName == 'ci'`)
• `scripts/{bootstrap-env,provision-apps}.sh`: default ENV is now `ci`; `ENV=dev` still accepted with a deprecation warning
• `.github/workflows/{cd,cd-cleanup,deploy-env,ci}.yml`: `deploy-dev` job → `deploy-ci`, matrix env list, default workflow_dispatch input

Phase B — docs sweep (commit `cb6021e`):

• `docs/environments.md` rewritten as a 4-tier table (local / ci / ppe / prod) with explicit `ASPNETCORE_ENVIRONMENT` mapping per tier and idle cost
• `docs/run-locally.md` opening promotes `local` to the documented first tier
• `glossary.md` gains entries for `ci`, `local`, `ppe` with primary-source citations
• Mechanical rename across operations.md, cost-zero.md, deploy-cloud.md, sample-setup.md, matrix.md, best-practices.md, README.md, DOCTRINE.md, coverage-map.md

Phase C — live cutover runbook (commit `6b39dfe`):

• `docs/operations.md` gains a "Renaming a deployment tier (one-shot live cutover)" runbook with the OIDC-safe step order (provision new tier → migrate `ENTRA_CONFIG_JSON` → smoke test → tear down old). The non-obvious bit is FIC subjects: the GitHub OIDC token's `sub` claim is matched verbatim against the FIC subject, so renaming the GH environment before the FIC fails with `AADSTS70021`.

Plus (commit `f35c5d2`): README's stale references to the deleted
credential-patterns demo (`orderservice` / `restaurantservice`) are
updated to the live app reg names (`orders-api` / `restaurants-api`).

Live cutover not yet executed

The PR is codebase-only. Live Azure / GitHub changes (provisioning
`rg-ftgo-ci-eastus`, migrating `ENTRA_CONFIG_JSON` to a new `ci` GH
env, updating FIC subjects, tearing down `rg-ftgo-dev-eastus`) are
deferred to a one-shot operation following the runbook in this PR
(`docs/operations.md` → "Renaming a deployment tier" section). Until
that happens, the `dev` tier still works because:

• `scripts/{bootstrap-env,provision-apps}.sh` accept `ENV=dev` as a
  deprecated alias and translate it to `ENV=ci` (with a stderr warning).
• The existing `dev` GitHub Environment is unchanged. The auto-CD
  push trigger will fail to find the `ci` env after this PR merges
  until the cutover runs — that's intentional, so the cutover is
  done deliberately, not as a side-effect of merge.

Verification

• ✅ `dotnet test EntraAuthPatterns.slnx` → 66/66
• ✅ `az bicep build` on every `.bicep` and every `.bicepparam` (BCP427 on the params is environment-variable interpolation in CI, expected)
• ✅ `actionlint .github/workflows/*.yml` clean
• ✅ `markdownlint-cli2` (CI's pinned version) clean
• ✅ The positive-path Restaurants 200 test (`RestaurantsApp_Allows_AppTokenWithRoleAndAllowListedAzp` in PR fix(security): Restaurants named-policy + ruleset CODEOWNER gate + scorecard pin refresh #102) still passes — that addresses the "we never tested 200" gap I previously surfaced
• 🟡 Live cloud probe deferred to the cutover (see runbook)

Out of scope (deliberate)

• Renaming `ppe` → `staging` (PPE is Microsoft jargon, kept by preference)
• Adding ephemeral PR-preview environments (separate doctrine decision)
• Cosmetic rename of the live app reg display names `ftgo-dev-{apigateway,orders-api,restaurants-api}` → `ftgo-ci-…`. The appIds (the only thing `ENTRA_CONFIG_JSON` references) are unchanged. Optional follow-up.