feat(migration): pivot global resource names to eu suffix

Cross-tenant re-claim of recently deleted global names is denied by
Azure by design (dangling-DNS/subdomain-takeover protection). New
tenant resources therefore use eu-suffixed names; the old names live
on in the old subscription (storage 'autopilotmonitor' recreated as
legacy bootstrap-URL keepalive, FuncApp/ACR kept as tombstones).

- API base URL -> autopilotmonitor-api-eu.azurewebsites.net
  (Shared Constants, web CSP + /go fallback, MCP default)
- Agent blob container + build counter -> autopilotmonitoreu
- deploy-backend app-name, deploy-mcp ACR -> eu names
- Bootstrap script URLs stay on the legacy storage (customers
  migrate once to a domain alias later)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/build-agent.yml

@@ -72,7 +72,7 @@ jobs:
         shell: pwsh
         run: |
           $counterBlob = "buildcounter-v$env:LINE_MAJOR.txt"
-          $counterUrl = "https://autopilotmonitor.blob.core.windows.net/agent/$counterBlob"
+          $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/$counterBlob"
           # Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...") -- the URL below adds the '?'.
           $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
           $override = "${{ inputs.build_number }}"
@@ -263,7 +263,7 @@ jobs:
         if: inputs.upload_blob
         shell: pwsh
         run: |
-          $containerUrl = "https://autopilotmonitor.blob.core.windows.net/agent"
+          $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
           $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
 
           function Send-Blob {

.github/workflows/deploy-backend.yml

@@ -39,5 +39,5 @@ jobs:
       - name: Deploy to Azure Functions
         uses: Azure/functions-action@v1
         with:
-          app-name: autopilotmonitor-api
+          app-name: autopilotmonitor-api-eu
           package: ./publish

.github/workflows/deploy-mcp.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  ACR_NAME: autopilotmonitoracr
+  ACR_NAME: autopilotmonitoreuacr
   CONTAINER_APP_NAME: autopilotmonitor-mcp
   RESOURCE_GROUP: ${{ secrets.AZURE_MCP_RESOURCE_GROUP }}
   IMAGE_TAG: ${{ github.sha }}

src/McpServer/autopilot-monitor-mcp/package.json

@@ -11,7 +11,7 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "docker:build": "docker build -f Dockerfile -t autopilotmonitor-mcp:local ../../../",
-    "docker:run": "docker run --rm -p 8080:8080 -e AUTOPILOT_API_URL=https://autopilotmonitor-api.azurewebsites.net autopilotmonitor-mcp:local",
+    "docker:run": "docker run --rm -p 8080:8080 -e AUTOPILOT_API_URL=https://autopilotmonitor-api-eu.azurewebsites.net autopilotmonitor-mcp:local",
     "test": "vitest run",
     "test:watch": "vitest"
   },

src/McpServer/autopilot-monitor-mcp/src/config.ts

@@ -11,7 +11,7 @@
  */
 import type { Request } from 'express';
 
-const DEFAULT_API_BASE_URL = 'https://autopilotmonitor-api.azurewebsites.net';
+const DEFAULT_API_BASE_URL = 'https://autopilotmonitor-api-eu.azurewebsites.net';
 
 function resolveApiBaseUrl(): string {
   const fromEnv = process.env.AUTOPILOT_API_URL?.trim();

src/Shared/AutopilotMonitor.Shared/Constants.cs

@@ -70,7 +70,7 @@ namespace AutopilotMonitor.Shared
         /// <summary>
         /// Default backend API base URL (overridable via AUTOPILOT_MONITOR_API env var or --api-url CLI arg)
         /// </summary>
-        public const string ApiBaseUrl = "https://autopilotmonitor-api.azurewebsites.net";
+        public const string ApiBaseUrl = "https://autopilotmonitor-api-eu.azurewebsites.net";
 
         /// <summary>
         /// Public base URL of the MCP server Container App (no trailing slash, no /mcp suffix).

src/Web/autopilot-monitor-web/app/go/[code]/route.ts

@@ -3,7 +3,7 @@ import { validateBootstrapResponse } from "@/utils/bootstrapValidation";
 export const runtime = "nodejs";
 
 const BACKEND_API_URL =
-  process.env.BACKEND_API_URL ?? "https://autopilotmonitor-api.azurewebsites.net";
+  process.env.BACKEND_API_URL ?? "https://autopilotmonitor-api-eu.azurewebsites.net";
 
 export async function GET(
   _req: Request,

src/Web/autopilot-monitor-web/next.config.ts

@@ -81,7 +81,7 @@ const nextConfig: NextConfig = {
               "style-src 'self' 'unsafe-inline'",
               "img-src 'self' data: blob: https://*.tile.openstreetmap.org",
               "font-src 'self'",
-              "connect-src 'self' https://autopilotmonitor-api.azurewebsites.net https://autopilotmonitor.blob.core.windows.net https://login.microsoftonline.com https://*.service.signalr.net wss://*.service.signalr.net https://js.monitor.azure.com https://*.in.applicationinsights.azure.com",
+              "connect-src 'self' https://autopilotmonitor-api-eu.azurewebsites.net https://autopilotmonitoreu.blob.core.windows.net https://login.microsoftonline.com https://*.service.signalr.net wss://*.service.signalr.net https://js.monitor.azure.com https://*.in.applicationinsights.azure.com",
               "frame-ancestors 'none'",
             ].join("; "),
           },