feat(deploy): automate Entra ID authentication configuration and sample bundle processing

[Dongbumlee]

Purpose

• Fully automate the previously-manual Entra ID authentication setup documented in docs/DeploymentGuide.md §5.2. After azd up, both Web and API container apps are registered, granted admin consent, configured for EasyAuth, and wired up — no portal clicks required.
• Add a post-deployment step that processes the bundled sample claims (claim_date_of_loss, claim_hail) end-to-end after schema/schemaset registration so first-time users see results immediately.
• Update docs/DeploymentGuide.md to reflect the new automated flow, with a manual fallback link kept for environments where the automation can't run.

The new automation is implemented in infra/scripts/configure_auth.sh / configure_auth.ps1 and invoked from post_deployment.sh / post_deployment.ps1. It is idempotent and safe to re-run.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Validated 5 full azd up deployments (deploytest-wsl through deploytest-wsl5) against a clean subscription. On the final cycle:

• Schema registration → schemaset → schema mapping → sample bundle processing (4 + 3 files for the two sample claims) → auth configuration all completed cleanly.
• Browser sign-in via Entra ID succeeded; SPA loaded and rendered claim results.
• Total provisioning time: ~17m 40s.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

Validated against both the standard profile and reviewed for compatibility with the AVM-based WAF profile (main.waf.parameters.json); ingress remains external on the Container Apps so the auth-config script's HTTPS calls work in both profiles. A note covering this has been added to the deployment guide.

What to Check

Verify that the following are valid

• infra/scripts/configure_auth.sh and .ps1 are functionally equivalent.
• post_deployment.sh Step 4 schema-id lookup correctly maps every file in a bundle to its schema (the previous bash array iteration only matched the first element).
• infra/main.bicep APP_WEB_AUTHORITY no longer produces a double-slash URL (environment().authentication.loginEndpoint already includes a trailing slash).
• docs/DeploymentGuide.md §5 reflects the automated flow; the manual docs/ConfigureAppAuthentication.md is preserved as a fallback.

Other Information

Bugs discovered and fixed during e2e validation:

1. globalValidation.redirectToProvider is not reliably populated by the az containerapp auth CLI flags — it must be set directly in the authConfig PUT, otherwise unauthenticated browser users get a 401 instead of being redirected to AAD.
2. az ad app permission admin-consent silently consents Microsoft Graph only and skips custom-API delegated scopes. The Web SP needs an explicit oauth2PermissionGrants POST for user_impersonation on the API app, or MSAL acquireTokenSilent fails after sign-in and the SPA renders blank.
3. az containerapp secret set does not trigger a new revision; the script now restarts the active Web + API revisions to apply changes.
4. APP_WEB_AUTHORITY in main.bicep had a redundant / between loginEndpoint and tenantId, breaking MSAL.js.
5. Bash array de-reference (for x in $ARR instead of ${ARR[@]}) caused only the first file in each sample bundle to upload; fixed with indexed iteration. (PowerShell path was already correct via hashtable lookup.)