chore(infra): IaC, compose, redis, oauth2-proxy baseline

[eoaksnes]

Stack 1/4 — base: `main`

Infra & deployment topology + oauth2-proxy split.

Stack

1. stack/01-infra ← you are here (base: main)
2. stack/02-api (base: stack/01-infra)
3. stack/03-web (base: stack/02-api)
4. stack/04-docs (base: stack/03-web)

---

This pull request introduces significant improvements to the infrastructure-as-code (IaC) and authentication setup for the project. The main focus is on automating and clarifying the provisioning of Entra ID (Azure AD) app registrations for secure authentication, updating environment and Docker Compose configurations, and enhancing documentation for developers. It also includes minor dependency and configuration cleanups.

Authentication and Infrastructure Automation:

• Added a comprehensive Bicep template (IaC/app-registration.bicep) to provision two Entra ID app registrations per environment: one for the API (resource server) and one for the BFF (oauth2-proxy, OIDC client), with support for custom owners, environments, and redirect URIs. Outputs are provided for use in local configuration.
• Introduced IaC/deploy-app-registration.sh, a robust shell script that wraps the Bicep deployment, interactively gathers required parameters, ensures correct Azure roles, resolves group owners, and securely creates a client secret for the BFF registration.
• Added IaC/deploy-resources.sh to automate deployment of environment-specific Azure resources defined in main.bicep.
• Updated bicepconfig.json to enable extensibility and pin the Microsoft Graph Bicep extension version.

Configuration and Environment Updates:

• Extended .env-template with new variables for Application Insights and optional service principal credentials, supporting telemetry and secure authentication.
• Updated docker-compose.override.yml to pass new authentication and telemetry environment variables to the API, and added an oauth2 service with debug settings and mounted config files. [1] [2]
• Changed nginx service dependencies to ensure oauth2 starts before nginx in docker-compose.yml.

Documentation Improvements:

• Expanded the README.md with a detailed section on the BFF authentication flow, instructions for running the new provisioning script, mapping outputs to configuration, and managing secrets.

Dependency and Config Cleanups:

• Updated .github/dependabot.yml to simplify dependency update groups and patterns.
• Downgraded the biomejs/pre-commit hook version in .pre-commit-config.yaml for compatibility.