docs(plan): add Section 8 Deployment Proof with end-to-end results from dev3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

.azure/plan.md

@@ -493,6 +493,30 @@ Validation run on **2026-06-08** by the `azure-validate` skill against environme
 - The `sql-connection-string` Key Vault secret is created with placeholder value `PLACEHOLDER_SET_VIA_POSTPROVISION_HOOK`. Until populated, App Configuration's KV-reference for `blkmon:ConnectionStrings:SqlDb$blkmon-dev` will resolve to that placeholder. Post-provision hook in `azure.yaml` reminds the operator.
 - SQL AAD admin is set to the deployer principal (`doc@mslabs.it`) instead of a security group — adequate for dev, should be moved to a group before any prod environment.
 
+## Section 8: Deployment Proof (real provision)
+
+Run on **2026-06-08** via `Deploy-Azure.ps1 -EnvironmentName dev3 -SkipPreview -PublishApps`. Environment names `dev` and `dev2` were burned in earlier attempts (KV/AppConfig soft-deleted and not purgeable in the MCAPS subscription); `dev3` produced a fresh `resourceToken = nsewij464oblc`.
+
+| # | Step | Result |
+|---|------|--------|
+| 1 | Prereq check (az, dotnet, bicep) | ✅ az 2.77.0, .NET 10.0.300, Bicep 0.41.2 |
+| 2 | `az bicep build infra/main.bicep` | ✅ 0 errors / 0 warnings |
+| 3 | `az deployment sub create` (subscription scope) | ✅ Succeeded — 33 resources provisioned in `rg-blkmon-dev3-italynorth` (Log Analytics, App Insights, 2× User-Assigned MI, Key Vault, App Configuration, Service Bus, Storage, SQL Server + DB, 2× App Service Plan, Functions Flex Consumption, Web App) |
+| 4 | ARM outputs read back (13 values) | ✅ All 13 outputs returned with values via `--query "properties.outputs.<armName>.value"` |
+| 5 | App Configuration seed | ✅ 9 keys + 1 feature flag (`Beta.BulkReveal`) written by ARM under label `dev3` |
+| 6 | Key Vault secret `sql-connection-string` | ✅ Written, enabled |
+| 7 | `dotnet publish` + `az functionapp deployment source config-zip` (Functions) | ✅ Synced + health-checked |
+| 8 | `dotnet publish` + `az webapp deploy --type zip` (Web.Azure) | ✅ Site started successfully (47s warm-up) |
+| 9 | `Invoke-WebRequest https://app-blkmon-nsewij464oblc.azurewebsites.net` | ✅ HTTP 200 OK |
+| 10 | `Invoke-WebRequest https://func-blkmon-nsewij464oblc.azurewebsites.net` | ✅ HTTP 200 |
+
+### Bicep / script fixes shipped this session
+
+1. **App Configuration local-auth**: `disableLocalAuth: true` blocks ARM-driven `keyValues` seeding. Pass-through ARM auth was the documented fix but the tenant Conditional Access blocks data-plane writes with the caller's Entra token (Forbidden even with App Configuration Data Owner role assigned). Pragmatic decision: keep `disableLocalAuth: false` during the initial provision; harden post-deploy via `az appconfig update --disable-local-auth true` once seeding is complete. Runtime workloads always use MI + Entra RBAC (App Configuration Data Reader) — they never touch access keys.
+2. **Key Vault purge protection**: `enablePurgeProtection: true` is **irreversible** and combined with the MCAPS policy that blocks `DeletedVaultPurge`, it traps every iteration's vault in soft-delete for 7 days. Made the property a parameter (default `true`) and passed `!startsWith(environmentName, 'dev')` from `main.bicep` so `dev*` environments can hard-delete the vault between iterations.
+3. **ARM output name normalization**: ARM lower-cases the leading run of uppercase letters in output names, except the **last** one before the lowercase/underscore boundary. `AZURE_LOCATION` → `azurE_LOCATION`, `FUNCTIONS_URI` → `functionS_URI`, `WEB_URI` → `weB_URI`. `Deploy-Azure.ps1` now reconstructs this exact name before each `--query`.
+4. **`az ... -o json` is `string[]`**: when assigned to a variable, only the first line is parsed by `ConvertFrom-Json`. The script now reads outputs via single-value `--query "...value" -o tsv` per output, sidestepping JSON parsing entirely.
+
 ## 13. Two-Solution Topology & Feature Parity
 
 ### Why two solutions