feat: prelaunch hardening — auth, rate limiting, SSE, consent, IaC

[dewitt4]

Closes out all six workstreams from .workitems/7.md (prelaunch verification). Summary by area:

Security (WS1A + WS1B)

• Add INTERNAL_SERVICE_TOKEN end-to-end: KV seeding in seed-keyvault.sh, Bicep injection into core + ai-service appSettings, FastAPI HTTP middleware validating X-Internal-Token on /api/ai/* routes, outbound header forwarded from core (public-api.controller, workflows.service, system-health.service)
• Tighten AI service CORS to CORE_API_URL only; remove FRONTEND_URL
• Add ipSecurityRestrictions to ai-service (prod only: allow snet-app)
• Add pe-ai-service.bicep private endpoint module, wired in after RBAC to avoid Bicep circular dependency; add peSubnetId + vnetId outputs to networking.bicep; add id output to app-service-container.bicep

Rate limiting (WS3)

• Add RedisService (ioredis, fail-open on outage) + RedisModule (@global)
• Rewrite RateLimitInterceptor to use Redis INCR+EXPIRE fixed-window counter; falls back to per-instance in-memory map when Redis is down
• Register RedisModule in AppModule; install ioredis package

SSE streaming (WS2)

• Restructure event_generator in streaming.py to hold a named stream reference; catch asyncio.CancelledError/GeneratorExit and always call stream.aclose() in finally — prevents unclosed-generator leaks on client disconnect

Migration concurrency guard

• Move migration execution out of TypeORM migrationsRun option
• Run migrations at bootstrap (main.ts) behind pg_advisory_lock so concurrent App Service instances serialize DDL; later holders find nothing pending and exit cleanly

Analytics / consent (WS5)

• Add CookieConsentContext (localStorage-persisted pending/accepted/ declined state) and CookieConsent banner component
• Add Analytics component: loads GA4 + Microsoft UET scripts via Next.js Script afterInteractive only after consent is accepted
• Wire both into app layout and providers

Docs + config (WS6)

• Add docs/azure/prelaunch-security-audit.md (9-category WS3/WS4 audit, all GO, including explicit section on Easy Auth being intentionally off)
• Update docs/azure/architecture.md: system context diagram, networking paragraph, secret inventory table
• Update docs/azure/pipeline.md: two service connections, updated variable group table, new §6 prelaunch checklist with GATE items
• Add INTERNAL_SERVICE_TOKEN, NEXT_PUBLIC_GA_MEASUREMENT_ID, NEXT_PUBLIC_MS_UET_TAG_ID to .env.example
• Update README infrastructure row: Docker · Azure App Service + Bicep