docs(security/azure): post-apply verification recipe for #50 uses wrong az command (Standard vs Consumption SKU)

[cristim]

Summary

The post-apply verification recipe for the scheduled-task secret migration (issue #50 / PR #74) references az logicapp show, but az logicapp targets Logic Apps Standard (Microsoft.Web/sites with kind=workflowapp). The Terraform here provisions Logic Apps Consumption (Microsoft.Logic/workflows via azurerm_logic_app_workflow). Running az logicapp show -n <wf> against a Consumption workflow returns ResourceNotFound.

The correct command (az logic workflow show) requires the logic extension, which currently fails to install on at least one local environment (Pip status 1 under brewed azure-cli + Python ≥ 3.12), so a recipe that depends on it is fragile too. The reliable, extension-free form is:

az resource show \
  --resource-type Microsoft.Logic/workflows \
  --api-version 2019-05-01 \
  -g <rg> -n <wf> \
  --query 'properties.definition.actions' \
  | jq '.["get-secret"], .["call-recommendations-endpoint"], .["call-ri-exchange-endpoint"], .["call-cleanup-endpoint"]'

After the #50 fix, get-secret should show authentication.type = "ManagedServiceIdentity" and audience https://vault.azure.net; the three call-*-endpoint actions should reference @body('get-secret')['value'] in the Authorization header — no plaintext.

Surfaces to fix

1. terraform/modules/compute/azure/container-apps/scheduled-tasks.tf:13 — header comment says az logicapp show. Source-tree fix; lands via a small PR against feat/multicloud-web-frontend.
2. PR fix(security/azure): migrate Logic App SCHEDULED_TASK_SECRET to Key Vault connection #74 description → "Test plan" — az logic show -n <wf>. Edit the merged PR body or post a corrective comment.
3. Issue fix(security/azure): Logic App workflow still embeds plaintext SCHEDULED_TASK_SECRET in Authorization header #50 → "Steps to reproduce" — az logicapp show --name <wf>. Closed; post a corrective comment so anyone landing here from search has the right recipe.

Why now

The fix is shipped and merged, but the operator-only post-apply check is still pending a real Azure deployment. Whoever runs that check next will follow the recipe in either #50, #74, or the source comment — all three currently send them down a dead end (wrong SKU, plus a broken extension).

Severity

Low — doc/comment only, no runtime impact.

Effort

Small — one-line comment fix in scheduled-tasks.tf, plus two corrective comments on the closed issue/PR.