fix: provision infrastructure in CI/CD to resolve DNS_PROBE_FINISHED_NXDOMAIN on poappidea-web

[Copilot]

poappidea-web.azurewebsites.net was returning DNS_PROBE_FINISHED_NXDOMAIN because the App Service resource didn't exist — the deploy workflow only pushed code and never provisioned infrastructure. Additionally, main.bicep referenced modules/keyvault-access.bicep which was missing, making any manual Bicep deployment fail immediately.

Changes

• infra/modules/keyvault-access.bicep (new) — RBAC module granting the web app's System-Assigned Managed Identity the Key Vault Secrets User role on kv-poshared, required for runtime secret resolution (AI keys, OAuth credentials)

• infra/main.bicep

  • appInsightsConnectionString made optional (= '')
  • APPLICATIONINSIGHTS_CONNECTION_STRING app setting conditionally included via concat() — avoids overwriting an existing value with an empty string when the secret isn't passed

  appSettings: concat(
    !empty(appInsightsConnectionString) ? [{ name: 'APPLICATIONINSIGHTS_CONNECTION_STRING', value: appInsightsConnectionString }] : [],
    [ /* storage, openai, oauth settings */ ]
  )

• .github/workflows/deploy.yml — two steps inserted after Azure Login, before code deploy:

  1. az group create --name PoAppIdea (idempotent)
  2. az deployment group create --mode Incremental using infra/main.bicep + main.bicepparam, with optional APPINSIGHTS_CONNECTION_STRING GitHub secret override

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.