Migrate AI Foundry auth to managed identity and update network architecture docs

[rvanmaanen]

Context

Follow-up to #305 (network security hardening). Once the VPN Gateway is removed and AI Foundry is accessed via private endpoint from Container Apps, the existing API key authentication becomes unnecessary and should be replaced with managed identity.

This issue also covers updating documentation to reflect the post-VPN architecture.

---

Changes

1. Migrate AI Foundry authentication: API key → managed identity

Container Apps currently authenticate to AI Foundry using an API key (AiCategorization:ApiKey config value, passed via api-key request header in AiCompletionClient). With the private endpoint in place, this should be replaced with managed identity (Azure RBAC).

What this involves:

• Assign the Cognitive Services OpenAI User role to the Container Apps managed identity on each AI Foundry resource
• Update AiCompletionClient to use DefaultAzureCredential / ManagedIdentityCredential and obtain a bearer token instead of passing the API key header
• Remove AiCategorization:ApiKey from app configuration and Key Vault secrets
• Remove the openAiApiKey secure output from infra/modules/openai.bicep
• Remove the corresponding Key Vault secret and any references in deployment workflows

Files to modify:

• src/TechHub.Infrastructure/Services/AiCompletionClient.cs
• src/TechHub.Core/Configuration/AiCategorizationOptions.cs — remove ApiKey property
• infra/modules/openai.bicep — remove openAiApiKey output
• infra/main.bicep — add role assignment for managed identity; remove API key secret wiring
• infra/modules/identity.bicep — add Cognitive Services OpenAI User role assignment

2. Update network architecture documentation

docs/network-architecture.md needs to reflect the post-VPN topology:

• Remove the VPN Gateway section and P2S client access description
• Add NSP section describing admin IP allowlist access
• Add AMPLS section describing private monitoring path
• Add AI Foundry PE section
• Update topology diagram

---

Acceptance Criteria

• Container Apps can call AI Foundry using managed identity (no API key in config)
• openAiApiKey output removed from openai.bicep
• AiCategorization:ApiKey config value no longer exists in any environment
• docs/network-architecture.md matches the actual post-VPN architecture
• All tests pass

---

References

• Plan document
• Depends on Network security hardening: replace VPN Gateway with NSP + AMPLS + AI Foundry PEs (~€143-183/month savings) #305