Add Azure Container Apps reference deployment (Bicep) - #15

Last remaining Phase 1 roadmap item. docker-compose.yml (the other
half of that bundled bullet) was already done.

Memory-only for this first pass, deliberately -- deploys the existing
core image completely as-is, no code changes to src/RiftCache. Key
Vault still gets provisioned and still backs RIFTCACHE_API_KEY,
because Azure Container Apps has native Key-Vault-backed secret
injection: the platform resolves the secret via the app's managed
identity before the container starts, so the app itself never needs
AzureKeyVaultSecretProvider code for that. Wiring
AzureBlobPersistenceProvider into an actual deployment is real
follow-up work -- Program.cs's DI wiring is plain top-level statements
today, not reusable, so that needs extracting into
AddRiftCacheCore()/MapRiftCacheCore() extensions plus a second
composed entry point + Dockerfile first. Tracked as an explicit new
unchecked ROADMAP line, not silently dropped.

Resources: Log Analytics Workspace, Container Apps Environment
(Consumption), a user-assigned Managed Identity, Key Vault (identity
granted Key Vault Secrets User), the API key as a Key Vault secret,
and the Container App itself (external ingress on 8080, matching the
Dockerfile's ASPNETCORE_HTTP_PORTS, 1-3 replicas -- no scale-to-zero
default, since a cache with zero warm replicas defeats its own
purpose). Image reference is a parameter; nothing is published
anywhere yet, so this template expects you to build and push your own
from deployment/docker/Dockerfile.

No live Azure subscription available in this environment, so this
wasn't deployment-tested end to end the way the Docker/Podman/Azurite
work was -- flagged explicitly rather than claimed. What's real:
installed the Bicep CLI locally (az bicep install, no Azure account
needed) and ran az bicep build / az bicep build-params, which both
compiled clean on the first try -- genuine schema validation against
Azure's real resource type definitions, not a syntax guess. Also
caught a real correctness point this way: the Container App's implicit
dependency inference doesn't pick up the Key Vault role assignment
(nothing in its properties references that resource symbolically), so
the explicit dependsOn on it is load-bearing, not redundant.

Also added .gitignore entries for compiled ARM JSON output and local
.bicepparam copies with real values filled in, and updated
README.md/ROADMAP.md now that this and Docker Compose cover the full
"reference deployment" bullet.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>