Automated Key Vault provisioning and secrets management

[arnaudlh]

Description

Deployed resources often require secrets (connection strings, API keys). Git-ape's copilot-instructions.md mentions Key Vault references (@Microsoft.KeyVault(...)) but there's no automated Key Vault provisioning or secrets wiring in the template generator.

Scope

1. Auto-provision Key Vault — When a deployment includes resources that need secrets, auto-include a Key Vault in the template.
2. Key Vault references — All app settings that contain secrets use @Microsoft.KeyVault(...) references instead of inline values.
3. Secrets rotation guidance — Post-deployment runbook section on secrets rotation.
4. Managed identity access — Auto-configure managed identity access policies on the Key Vault.

Acceptance Criteria

• Deployments with secret-consuming resources auto-include Key Vault.
• App settings use Key Vault references.
• Managed identity access to Key Vault is configured.
• Secrets rotation guidance included in post-deployment documentation.