feat: cut over Azure CD to Bicep-driven MSA Container Apps deploy

[Atsilut]

Summary

• Refactors infra/azure/main.bicep so parameters.prod.json is the single source of truth for all MSA Container Apps (gateway, users, media, chat, location, community, group, social, web, workers, monitoring) and per-service EF migrate jobs.
• Replaces cd-v1 with cd-v2: drops azure-cd-inject-secrets.sh and azure-cd-deploy-image.sh in favor of azure-cd-deploy-bicep.sh, which passes GitHub Environment secrets as Bicep @secure() parameters at deploy time.
• Updates CD scripts to build/push all MSA service images, run migrate jobs from parameters.prod.json, and refresh deployment docs for the new pipeline.

Test plan

• az deployment group what-if against a dev resource group with parameters.dev.json
• Manual azure-cd-deploy-bicep.sh dry run with placeholder images (USE_PLACEHOLDER_IMAGES=true)
• Verify azure-cd-migrate.sh discovers and runs all migrateJobs from parameters.prod.json
• Confirm azure-cd-build-push.sh builds gateway + all domain service runtime images
• Review cd-v2.yml secret/env mapping against GitHub prod environment
• After first prod deploy: smoke /health via gateway and delete orphaned tangle-study-api / tangle-study-migrate resources if still present

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.