Add Azure Key Vault to Bicep infrastructure with managed identity access

[workcontrolgit]

Summary

• Add infra/modules/keyVault.bicep — provisions kv-talent-dev with Standard SKU, RBAC authorization, and soft-delete (7 days)
• Update infra/modules/webApp.bicep — enable system-assigned managed identity on all web apps; expose principalId output
• Update infra/main.bicep — add keyVaultName parameter, wire Key Vault module with all three web app principal IDs (API, STS, Admin), add keyVaultUri output
• Update infra/parameters/dev.bicepparam — add keyVaultName = 'kv-talent-dev'

How it works

Each App Service gets a system-assigned managed identity. The Key Vault module grants the Key Vault Secrets User role to each identity, allowing apps to read secrets without storing credentials in config. Connection strings can then be stored as Key Vault secrets and referenced in App Service settings via the @Microsoft.KeyVault(SecretUri=...) syntax.

Test plan

• Run az deployment group create with updated Bicep to verify no deployment errors
• Confirm kv-talent-dev Key Vault is created in rg-talent-dev
• Confirm all three App Services show a system-assigned managed identity
• Confirm RBAC role assignments appear on the Key Vault for each identity