Add Bicep Infrastructure as Code for Azure resource provisioning

[Copilot]

All Azure resources are currently provisioned manually. This adds declarative Bicep templates under infra/ so the environment can be provisioned and updated consistently via CI.

Bicep modules

infra/
├── main.bicep           # Root template — parameters, module wiring, outputs
├── main.bicepparam      # Example parameter values
└── modules/
    ├── appservice.bicep # App Service Plan (Linux) + App Service (DOTNETCORE|10.0)
    ├── monitoring.bicep # Log Analytics Workspace + workspace-based Application Insights
    ├── sql.bicep        # SQL Server + Database (Basic SKU) + Azure-services firewall rule
    └── storage.bicep    # StorageV2 account with static website enabled

• App Service is wired to Application Insights at provisioning time via the APPLICATIONINSIGHTS_CONNECTION_STRING app setting
• UseInMemoryDatabase is forced to false on the App Service
• Static website (index.html / 404 → index.html) is configured on the storage account; the staticWebsite property on blobServices is suppressed with #disable-next-line BCP037 due to a known Bicep type-definition gap

CI

A new deploy-infrastructure job runs infra/main.bicep via azure/arm-deploy@v2 on every push to main, before deploy-backend. The deployment is idempotent.

New GitHub configuration required

Variables: AZURE_LOCATION, AZURE_APP_SERVICE_PLAN_NAME, AZURE_APP_SERVICE_PLAN_SKU, AZURE_SQL_SERVER_NAME, AZURE_SQL_DATABASE_NAME, AZURE_SQL_ADMIN_LOGIN, AZURE_LOG_ANALYTICS_WORKSPACE_NAME, AZURE_APP_INSIGHTS_NAME

Secret: AZURE_SQL_ADMIN_PASSWORD (admin password passed to Bicep at deploy time; distinct from the existing runtime AZURE_SQL_CONNECTION_STRING)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• aka.ms
  • Triggering command: /usr/local/bin/bicep bicep build infra/main.bicep (dns block)
  • Triggering command: /usr/local/bin/bicep bicep lint infra/main.bicep (dns block)
  • Triggering command: /usr/local/bin/bicep bicep lint infra/modules/monitoring.bicep (dns block)
• azcliprod.blob.core.windows.net
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli bicep install (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

Backend Test Results

9 tests  ±0   9 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7664d35. ± Comparison against base commit cc32ce4.

♻️ This comment has been updated with latest results.

[github-actions]

E2E Test Results

15 tests  ±0   15 ✅ ±0   7s ⏱️ -6s
 3 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 7664d35. ± Comparison against base commit cc32ce4.

♻️ This comment has been updated with latest results.