feat: Restrict backend API to private access in WAF deployment

[Prajwal-Microsoft]

Purpose

When enablePrivateNetworking (WAF mode) is active, the backend API App Service (api-{suffix}) was still publicly accessible on the internet. This PR restricts the backend API to private-only access while keeping the frontend Web App publicly reachable — aligning with the WAF security posture.

Changes

Infrastructure (infra/main.bicep & infra/main_custom.bicep):

• Added privatelink.azurewebsites.net private DNS zone linked to VNet
• Created private endpoint for backend API in the backend subnet
• Set publicNetworkAccess: 'Disabled' for the backend API when enablePrivateNetworking=true
• Frontend sets VITE_API_BASE_URL to empty (same-origin) and passes BACKEND_API_URL for the nginx proxy

Frontend (src/App/):

• nginx.conf: Added include for dynamically generated API proxy config
• startup.sh: Generates nginx reverse proxy config at container startup — proxies /api/* to backend over VNet using Azure DNS resolver (168.63.129.16). Sets VITE_API_BASE_URL to window.location.origin in WAF mode so the SPA correctly calls its own origin
• Dockerfile: Creates empty placeholder api-proxy.conf during build

Architecture (WAF mode)

Browser → Frontend App (public) → nginx /api/* proxy → VNet → Backend API (private endpoint)

Non-WAF deployments are unchanged — direct public API access continues as before.

Resolves AB#39249

Does this introduce a breaking change?

• Yes
• No

How to Test

• Deploy using WAF parameters:

# Copy WAF params and deploy
cp infra/main.waf.parameters.json infra/main.parameters.json
azd up

• After deployment, run post-deployment scripts (data upload + agent creation)
• Verify backend API is blocked from public internet:

curl https://api-{suffix}.azurewebsites.net/health   # Should return 403 Ip Forbidden

• Verify frontend is accessible and API works through proxy:

curl https://app-{suffix}.azurewebsites.net           # Should return 200
curl https://app-{suffix}.azurewebsites.net/api/products/  # Should return product data

What to Check

Verify that the following are valid

• Backend API returns 403 Ip Forbidden from public internet in WAF deployment
• Frontend Web App is publicly accessible (200 OK)
• Products load on the frontend (API calls proxied through nginx)
• Chat functionality works end-to-end
• Non-WAF deployment still works as before (no regressions)

Other Information

• Tested with full WAF deployment to Australia East on CSA-CTO-Engineering-Maintenance subscription
• Playwright e2e tests: 7/11 passed (4 failures are pre-existing and unrelated to this change)
• The nginx proxy uses Azure DNS resolver 168.63.129.16 for private DNS resolution and proxy_ssl_server_name on for SNI