feat: Azure ACR push and WebApp deployment for terrain-gpu-demo

[maxfelker]

Summary

Adds Azure infrastructure and CI/CD pipeline to build, push, and deploy the terrain-webgpu Docker image to a new terrain-gpu-demo Azure WebApp.

What's included

.azure/ — Bicep infrastructure

• main.bicep — defines:
  • App Service Plan ASP-terrain-gpu (B1, Linux)
  • WebApp terrain-gpu-demo with system-assigned managed identity
  • AcrPull role assignment on maxfelkershared ACR for the managed identity (no stored credentials at runtime)
• main.bicepparam — deployment parameters
• README.md — documents layout and az deployment group create usage

.github/workflows/deploy.yml — Deploy workflow

Triggers on push to main. Uses OIDC workload identity federation — no stored secrets or client passwords:

1. azure/login@v2 with AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID
2. az acr login for ephemeral ACR token (no username/password)
3. Build & push maxfelkershared.azurecr.io/terrain-gpu:${{ github.sha }} + :latest
4. Deploy to terrain-gpu-demo in maxfelker.com resource group

Security

• ✅ OIDC federated identity credentials (no client secrets)
• ✅ Managed identity for WebApp → ACR auth at runtime
• ✅ GitHub secrets: only AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID

Deploy infrastructure (one-time)

az deployment group create \
  --resource-group maxfelker.com \
  --template-file .azure/main.bicep \
  --parameters .azure/main.bicepparam