feat: add Azure/Caddy staging infra, GitHub Pages portfolio, and hardened CI for Module 14 prep

[MohanEhab]

Summary

• Infrastructure-as-code, staging gateway, and evidence-hub prep for Module 14, plus a GitHub Pages portfolio page. Docs/infra only, no product module code.

What changed

• New infra/azure/main.bicep (Azure IaC).
• New ops/gateway/{Caddyfile,Dockerfile} and ops/staging/{compose.yaml,Caddyfile,.env.example,cors.staging.example.json,README.md} for a same-origin staging gateway stack.
• New docs/devops/{README,azure-student-deployment,github-hardening-checklist,github-pages,release-evidence}.md.
• New .github/workflows/{azure-deploy.yml,ci.yml,deploy-pages.yml,publish-gateway-image.yml}.
• New portfolio/index.html (zero-dependency GitHub Pages portfolio).
• README.md / .gitignore updated for the new evidence-hub links and ops/staging/.env.

Tests

• N/A (infra/docs only); workflows are self-validating via GitHub Actions once merged.

Security/docs

• docs/devops/github-hardening-checklist.md documents the hardening steps taken; no secrets committed (.env.example only, real .env files remain untracked).

Risks/deferred

• This is preparatory scaffolding for Module 14, not a claim that Module 14 is complete or that anything is deployed to production.
• Azure/staging deployment still requires a human-configured provider and credentials before any of this infra is actually stood up.