ci: switch Azure deploy login to secret-less OIDC (federated credential)

deploy-backend + deploy-mcp now authenticate via azure/login OIDC (client-id/tenant-id/subscription-id + id-token permission) instead of the AZURE_CREDENTIALS service-principal secret. Adds temporary oidc-login-test workflow to smoke-test the federated login. Federated credential 'github-main' (repo:okieselbach/Autopilot-Monitor:ref:refs/heads/main) created on the deploy app registration.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/deploy-backend.yml

@@ -3,6 +3,10 @@ name: Deploy Backend (Azure Functions)
 on:
   workflow_dispatch:
 
+permissions:
+  id-token: write   # OIDC federated login (secret-less)
+  contents: read
+
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
@@ -11,10 +15,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Login to Azure
+      - name: Login to Azure (OIDC)
         uses: azure/login@v3
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 8
         uses: actions/setup-dotnet@v5

.github/workflows/deploy-mcp.yml

@@ -3,6 +3,10 @@ name: Deploy MCP Server (Container App)
 on:
   workflow_dispatch:
 
+permissions:
+  id-token: write   # OIDC federated login (secret-less)
+  contents: read
+
 env:
   ACR_NAME: autopilotmonitoracr
   CONTAINER_APP_NAME: autopilotmonitor-mcp
@@ -17,10 +21,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Login to Azure
+      - name: Login to Azure (OIDC)
         uses: azure/login@v3
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Login to ACR
         run: az acr login --name ${{ env.ACR_NAME }}

.github/workflows/oidc-login-test.yml

@@ -0,0 +1,28 @@
+# TEMPORARY: proves the secret-less OIDC federated login works end-to-end.
+# Delete after the cross-tenant migration is verified (or keep as a cheap smoke test).
+name: OIDC Login Test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  login-test:
+    runs-on: ubuntu-latest
+    name: Federated login + read check
+    steps:
+      - name: Login to Azure (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Prove identity and RBAC scope
+        run: |
+          az account show --query "{subscription:name, subscriptionId:id, tenantId:tenantId, user:user.name}" -o json
+          echo "--- function app visible with Contributor scope? ---"
+          az functionapp list --query "[].name" -o json