chore(backend): upgrade Functions from .NET 8 to .NET 10 isolated

- Target framework: net8.0 -> net10.0 (Functions + Tests)
- Microsoft.Identity.Web 4.3.0 -> 4.8.0 (transitively pulls AspNetCore 10.x)
- Microsoft.AspNetCore.Authentication.JwtBearer 8.0.11 -> 10.0.7
- Microsoft.Extensions.Http.Polly 8.0.25 -> 10.0.7
- Pin Microsoft.AspNetCore.DataProtection 10.0.7 to override transitive
  10.0.0 (GHSA-9mv3-2cwr-p262 critical, GHSA-37gx-xxp4-5rgx +
  GHSA-w3x6-4m5h-cxqf high in Cryptography.Xml)
- Add global.json pinning SDK 10.0.x latestFeature, allowPrerelease=false
- CI deploy-backend workflow: setup-dotnet 8.0.x -> 10.0.x ga

Tests: 781/781 passing on net10.0.

Runtime stack switch on the Function App ("Stack settings" in portal:
.NET 8 Isolated -> .NET 10 Isolated) must be done manually after deploy.

Out of scope (carry as follow-ups):
- SYSLIB0057 (X509Certificate2 ctor obsolete) in CertificateValidator.cs:69
- Optional bumps surfaced by 'list package --outdated':
  Azure.Identity 1.19->1.21, Azure.Storage.Blobs 12.22->12.27,
  Azure.Data.Tables 12.9->12.11, SignalR.Management 1.29->1.33,
  Newtonsoft.Json 13.0.3->13.0.4. Major bumps deferred:
  ApplicationInsights.WorkerService 2.x->3.x, Resend 0.2->0.5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-backend.yml

@@ -16,10 +16,11 @@ jobs:
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
-      - name: Setup .NET 8
+      - name: Setup .NET 10
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
+          dotnet-quality: 'ga'
 
       - name: Restore dependencies
         run: dotnet restore src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj

global.json

@@ -0,0 +1,7 @@
+{
+  "sdk": {
+    "version": "10.0.100",
+    "rollForward": "latestFeature",
+    "allowPrerelease": false
+  }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AutopilotMonitor.Functions.Tests.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>

src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <AzureFunctionsVersion>V4</AzureFunctionsVersion>
     <OutputType>Exe</OutputType>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -42,9 +42,11 @@
     <PackageReference Include="Azure.Storage.Blobs" Version="12.22.2" />
     <PackageReference Include="Azure.Storage.Queues" Version="12.23.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Microsoft.Identity.Web" Version="4.3.0" />
+    <PackageReference Include="Microsoft.Identity.Web" Version="4.8.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.11" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
-    <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="8.0.25" />
+    <!-- Pin to override transitive 10.0.0 brought in by Microsoft.Identity.Web; 10.0.0 has GHSA-9mv3-2cwr-p262 (critical). -->
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
+    <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.7" />
     <PackageReference Include="Resend" Version="0.2.1" />
   </ItemGroup>