refactor: prod-readiness + clean-code wave (no narrative comments, hardened defaults)

[mghabin]

Audit-driven cleanup wave addressing the user's three complaints: (1) too much narrative commentary, (2) not prod-ready, (3) not following Microsoft prod-code conventions / .NET design patterns / clean code.

What changed (3 axes)

1. Comment cull (user's #1 complaint)

Centralized doctrine, removed duplicated narrative essays, kept only the comments that prevent real bugs (security rationale, non-obvious gotchas — max 1-2 lines each).

• Bicep: cd-bootstrap.bicep 16-line role-assignment recovery essay → 2-line pointer; aca-stack.bicep 11-line BCP138 paragraph → succinct doc + structured @metadata; app-registrations.bicep 12-line FIC essay → 5-line block.
• Bash scripts: bootstrap-env.sh 25-line + provision-apps.sh 38-line headers → 5-9 line orientation + pointers to docs/.
• Authorization doctrine: 5+ duplicated narrative blocks across Orders.Api and Restaurants.Api source files → centralized in DOCTRINE.md new section Authorization-policy doctrine (canonical) covering the two-named-policy rule, the [Authorize(Roles=...)] trap with MapInboundClaims=false, and the azp allow-list rationale. Source files now reference DOCTRINE.md in 1-line summaries.

2. DevOps fixes

• pinact job rename: verify → pinact to match the required-status-check name in the ruleset. Real bug — currently dormant because all merges use --admin bypass.
• secrets: inherit → explicit pass-through: declared secrets: block in deploy-env.yml's workflow_call, pass AZURE_TENANT_ID: explicitly from cd.yml. Defense in depth.
• timeout-minutes on every job (5-45 min depending on workload).
• Bash hardening: IFS=$'\\n\\t', trap ERR, split SC2155 declare/assign in provision-apps.sh.
• Bicep API bumps (3 of 14 resources were stale): Microsoft.App/{containerApps,managedEnvironments} preview → 2025-07-01 GA; Microsoft.KeyVault/vaults preview → 2024-11-01 GA. The other 11 resources were already on the latest GA.

3. Prod-readiness

• Kestrel hardening: ConfigureEntraAuthKestrel() pins MaxRequestBodySize=10 MB, RequestHeadersTimeout=30s, KeepAliveTimeout=65s, AddServerHeader=false. Wired into all 3 web services. Closes a DoS gap where defaults are effectively unlimited.
• HTTPS redirect at app level: AddEntraAuthHttpsRedirection() registers a 308 permanent redirect; UseHttpsRedirection() in middleware. Defense in depth alongside ACA's allowInsecure: false edge enforcement.
• EntraAuthRateLimiterOptions validator: bounds checks on PermitLimit/AppPermitLimit/Window/SegmentsPerWindow. AddEntraAuthRateLimiter now fails fast on misconfig instead of silently breaking.
• Test coverage gap closed: DownstreamProbeServiceTests (success-path log + exception-path ExitCode=1 + StopApplication) — the worker startup probe was untested. EntraAuthRateLimiterOptionsValidatorTests covers fail-fast behaviour.
• nuget.config with packageSourceMapping pinning all packages to nuget.org (defense against transitive package-source injection).

What I deliberately did NOT change

• Comments that prevent real bugs: security rationale on MixedClaimsPolicies, RequireClientApp, EntraAuthSecurityHeadersExtensions. The audit's first-pass agent argued these are "all justified" — I disagreed for the doctrine duplication but agreed for the security-policy rationale (1-2 lines each, prevents subtle bugs).
• CAF resource naming (cosmetic).
• Diagnostic settings on every PaaS (KV + LAW already have them; App Insights doesn't really need them for this sample).
• TimeProvider injection (premature — no time-sensitive business logic).

Verification

• dotnet test EntraAuthPatterns.slnx → 72/72 (was 66; +6 from this PR).
• az bicep build on every .bicep + .bicepparam — no errors.
• actionlint .github/workflows/*.yml — clean.
• shellcheck scripts/*.sh — clean.

Out of scope (still tracked separately)

• test: migrate Ftgo.Auth.Tests to Microsoft.Testing.Platform runner (blocked on package compat) #80 — M.T.P runner migration (upstream blocker, re-checked this session).
• test: add WebApplicationFactory<Program> integration tests for one resource API #83 — WebApplicationFactory<Program> migration for RestaurantsAppPolicyEndToEndTests.
• infra: convert kitchen-worker from Container App to Container Apps Job #85 — kitchen-worker → ACA Job conversion.