feat(web.azure): Phase 0 scaffold for on-prem portal port

Adds package references needed for Phase 1 (Entra ID auth + Azure SQL via managed identity + Serilog parity):

- Microsoft.Identity.Web.UI 4.10.0 (signin/signout/AccessDenied pages)

- Azure.Identity 1.21.0 (matches Core's transitive version)

- Serilog.AspNetCore 10.0.0 (parity with on-prem Web)

Drops a documented appsettings.Phase1.json placeholder describing the AzureAd/Authorization/ConnectionStrings shape Phase 1 will consume; Program.cs untouched (deployment-status landing still served).

Build green; 109 Azure-side tests still pass; on-prem unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

src/BitLockerKeyMonitor.Web.Azure/BitLockerKeyMonitor.Web.Azure.csproj

@@ -5,8 +5,18 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!-- Phase 0: scaffold for porting BitLockerKeyMonitor.Web from on-prem to Azure.
+         Auth: Microsoft.Identity.Web (Entra ID OIDC) replaces the on-prem Negotiate/Kerberos handler.
+         UI: Microsoft.Identity.Web.UI provides ready signin/signout/AccessDenied pages.
+         AppConfig: pulls the same blkmon:* keys the Functions consumes.
+         Azure.Identity: DefaultAzureCredential for SQL DbContext access token + AppConfig.
+         Serilog: parity with the on-prem portal logging configuration.
+         Phase 1 will wire Program.cs DI; Phase 2 will copy the read-only pages. -->
     <PackageReference Include="Microsoft.Extensions.Configuration.AzureAppConfiguration" Version="8.5.0" />
     <PackageReference Include="Microsoft.Identity.Web" Version="4.10.0" />
+    <PackageReference Include="Microsoft.Identity.Web.UI" Version="4.10.0" />
+    <PackageReference Include="Azure.Identity" Version="1.21.0" />
+    <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
   </ItemGroup>
 
   <PropertyGroup>

src/BitLockerKeyMonitor.Web.Azure/appsettings.Phase1.json

@@ -0,0 +1,32 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*",
+
+  // ---- Phase 1 placeholders (NOT yet read by Program.cs) ----
+  // Auth: Entra ID app registration to be created by `az ad app create` in Phase 1.
+  // ClientId, TenantId, Instance get seeded into App Configuration; admin/viewer
+  // security group object IDs likewise. Domain is the Entra primary domain.
+  "AzureAd": {
+    "Instance": "https://login.microsoftonline.com/",
+    "Domain": "",
+    "TenantId": "",
+    "ClientId": "",
+    "CallbackPath": "/signin-oidc",
+    "SignedOutCallbackPath": "/signout-callback-oidc"
+  },
+  "Authorization": {
+    "AdminGroupObjectId": "",
+    "ViewerGroupObjectId": ""
+  },
+  "ConnectionStrings": {
+    // Populated from App Configuration KV-reference `blkmon:ConnectionStrings:SqlDb`
+    // which resolves to the Key Vault secret `sql-connection-string` (Active Directory
+    // Default auth via the Web UAMI).
+    "DefaultConnection": ""
+  }
+}