docs(web.azure): replace scaffold pages with deployment-status landing

The web app deployed at app-blkmon-*.azurewebsites.net was serving the
default Blazor template (Hello world / Counter / Weather), which made
it look like the deploy was broken or the portal was missing. It's
neither - Web.Azure is intentionally a placeholder because the
interactive portal (DeviceList, Audit, KeyValueVault, Settings) has not
been ported from BitLockerKeyMonitor.Web on-prem to the Azure project.

This commit replaces the scaffold content so the homepage explains:
- the Azure deployment is the infrastructure layer (Functions, KV, SB,
  App Config, SQL, Log Analytics audit mirror)
- the operational portal still runs on-prem
- Phase 3 sealed-batch protocol status

Pages removed: Counter.razor, Weather.razor (template artifacts).
NavMenu updated to drop their nav links and rebrand to
\"🔐 BitLockerKeyMonitor (Azure)\".

The future port (or removal) of the Web.Azure project is a separate
strategic decision tracked in the session plan.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

src/BitLockerKeyMonitor.Web.Azure/Components/Layout/NavMenu.razor

@@ -1,6 +1,6 @@
-<div class="top-row ps-3 navbar navbar-dark">
+<div class="top-row ps-3 navbar navbar-dark">
     <div class="container-fluid">
-        <a class="navbar-brand" href="">BitLockerKeyMonitor.Web.Azure</a>
+        <a class="navbar-brand" href="">🔐 BitLockerKeyMonitor (Azure)</a>
     </div>
 </div>
 
@@ -13,18 +13,6 @@
                 <span class="bi bi-house-door-fill-nav-menu" aria-hidden="true"></span> Home
             </NavLink>
         </div>
-
-        <div class="nav-item px-3">
-            <NavLink class="nav-link" href="counter">
-                <span class="bi bi-plus-square-fill-nav-menu" aria-hidden="true"></span> Counter
-            </NavLink>
-        </div>
-
-        <div class="nav-item px-3">
-            <NavLink class="nav-link" href="weather">
-                <span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather
-            </NavLink>
-        </div>
     </nav>
 </div>
 

src/BitLockerKeyMonitor.Web.Azure/Components/Pages/Counter.razor

@@ -1,7 +1,61 @@
-@page "/"
+@page "/"
+@using System.Reflection
 
-<PageTitle>Home</PageTitle>
+<PageTitle>BitLocker Key Monitor - Azure Deployment</PageTitle>
 
-<h1>Hello, world!</h1>
+<h1>🔐 BitLocker Key Monitor</h1>
+<p class="lead text-muted">Azure-native deployment</p>
 
-Welcome to your new app.
+<div class="alert alert-info" role="alert">
+    <h4 class="alert-heading">Operational portal is on-premises</h4>
+    <p class="mb-1">
+        This site is the <strong>Azure-native deployment</strong> placeholder for BitLocker Key Monitor.
+        The interactive portal (device list, recovery keys, audit log, settings) currently runs
+        <strong>on-premises</strong> on the dedicated Windows Server &mdash; the Blazor UI has not
+        been ported to Azure yet.
+    </p>
+    <hr />
+    <p class="mb-0">
+        This deployment exists to verify that the Azure-side infrastructure provisioned by
+        <code>infra/main.bicep</code> (Functions producer, Key Vault, App Configuration, Service Bus,
+        SQL Database, Log Analytics audit mirror) is reachable end-to-end. Cloud-only dashboards
+        (Log Analytics queries, Phase 3 sealed-batch telemetry) can be added here in the future.
+    </p>
+</div>
+
+<h2 class="mt-4">Deployed Azure components</h2>
+<ul>
+    <li><strong>Azure Functions</strong> &mdash; scan triggers + Phase 3 DEK sealing producer (Flex Consumption)</li>
+    <li><strong>Azure Key Vault</strong> &mdash; <code>blkmon-kek</code> (operational KEK, RSA-OAEP wrap/unwrap)
+        + <code>blkmon-agent-seal</code> (Phase 3 envelope sealing, RSA-OAEP encrypt/decrypt)</li>
+    <li><strong>Azure App Configuration</strong> &mdash; environment-labelled keys consumed by Functions</li>
+    <li><strong>Service Bus</strong> &mdash; queues <code>scan-triggers</code>, <code>ad-events</code>,
+        <code>dek-sealed-batches</code> (Phase 3 sealed envelopes to on-prem HybridAgent)</li>
+    <li><strong>Azure SQL Database</strong> &mdash; Entra ID authentication via Managed Identity</li>
+    <li><strong>Log Analytics</strong> &mdash; <code>BitLockerKeyMonitorAudit_CL</code> custom table fed via DCR</li>
+</ul>
+
+<h2 class="mt-4">Phase 3 status</h2>
+<p>
+    The sealed-DEK batch protocol (Functions → on-prem HybridAgent via Key Vault envelope + Service Bus
+    queue) is implemented and the Azure-side infrastructure is live. The consumer (HybridAgent)
+    needs an Entra ID identity provisioned and its on-prem deployment wired before sealed batches
+    can flow end-to-end. See <code>docs/ENCRYPTION-BRIEFING.md</code> for the full security model.
+</p>
+
+<hr class="mt-4" />
+<small class="text-muted">
+    Build: @AssemblyVersion &middot; Environment: @EnvironmentName
+</small>
+
+@code {
+    private static readonly string AssemblyVersion =
+        typeof(Home).Assembly
+            .GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion
+        ?? typeof(Home).Assembly.GetName().Version?.ToString()
+        ?? "unknown";
+
+    [Inject] public required IWebHostEnvironment Environment { get; set; }
+
+    private string EnvironmentName => Environment.EnvironmentName;
+}