ci(deploy): host frontend on App Service instead of SWA

SWA is unavailable in our region-locked subscription (israelcentral
and nearby). Deploy the built Vite dist/ to a Linux App Service named
app-groundshare-web via zip deploy, using `pm2 serve --spa` as the
startup command so client-side routes fall back to index.html.

Also add the new frontend origin to the backend CORS allowlist so
API calls from the SPA succeed in production.

Author: Yuval

.github/workflows/cd.yml

@@ -1,15 +1,21 @@
 # ---------------------------------------------------------------------------
 # CD Pipeline — deploy backend + frontend to Azure on push to main
 # ---------------------------------------------------------------------------
-# Phase 7.5/7.6: Triggered after CI passes on main branch.
+# Triggered after CI passes on main branch.
 #
 # Jobs:
 #   1. backend  — publish .NET 8 app → Azure App Service (zip deploy)
-#   2. frontend — build Vite app → Azure Static Web Apps
+#   2. frontend — build Vite app → Azure App Service (static host w/ SPA fallback)
+#
+# Why App Service for frontend instead of Static Web Apps?
+# The Azure subscription is region-locked (israelcentral / swedencentral / etc.)
+# and SWA is not available in those regions. App Service is, so we host the
+# built `dist/` on a Linux App Service using the built-in `pm2 serve` command
+# with `--spa` so client-side routes fall back to index.html.
 #
 # Required GitHub Secrets:
-#   - AZURE_WEBAPP_PUBLISH_PROFILE  (App Service publish profile XML)
-#   - AZURE_STATIC_WEB_APPS_API_TOKEN (SWA deployment token)
+#   - AZURE_WEBAPP_PUBLISH_PROFILE           (backend App Service publish profile XML)
+#   - AZURE_WEBAPP_FRONTEND_PUBLISH_PROFILE  (frontend App Service publish profile XML)
 #
 # Gating via GitHub Repository Variables (Settings > Secrets and variables >
 # Actions > Variables tab):
@@ -108,12 +114,35 @@ jobs:
         env:
           VITE_API_BASE_URL: https://app-groundshare-api.azurewebsites.net/api
 
-      - name: Deploy to Azure Static Web Apps
-        uses: Azure/static-web-apps-deploy@v1
+      # Zip only the built dist/ so the App Service wwwroot contains the SPA
+      # files at its root. The App Service Startup Command serves them via:
+      #   pm2 serve /home/site/wwwroot --no-daemon --spa
+      # `--spa` makes unmatched routes fall back to index.html so client-side
+      # routing (React Router) works on deep links and page refreshes.
+      - name: Package dist
+        working-directory: 03-Client
+        run: |
+          cd dist
+          zip -r ../deploy-frontend.zip .
+
+      - name: Deploy to Azure App Service (frontend)
+        uses: azure/webapps-deploy@v3
         with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }}
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          action: upload
-          app_location: 03-Client/dist
-          skip_app_build: true
-          skip_api_build: true
+          app-name: app-groundshare-web
+          publish-profile: ${{ secrets.AZURE_WEBAPP_FRONTEND_PUBLISH_PROFILE }}
+          package: 03-Client/deploy-frontend.zip
+
+      - name: Health check
+        run: |
+          sleep 30
+          for i in 1 2 3 4 5; do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://app-groundshare-web.azurewebsites.net/ || true)
+            if [ "$STATUS" = "200" ]; then
+              echo "Health check passed"
+              exit 0
+            fi
+            echo "Attempt $i: status $STATUS, retrying in 15s..."
+            sleep 15
+          done
+          echo "Health check failed after 5 attempts"
+          exit 1

02-Server/appsettings.json

@@ -29,7 +29,8 @@
     "AllowedOrigins": [
       "http://localhost:5173",
       "http://localhost:4173",
-      "https://localhost:5173"
+      "https://localhost:5173",
+      "https://app-groundshare-web.azurewebsites.net"
     ]
   }
 }