Harden SPIRE networking and deployment secret storage

[brandwe]

The prototype still carries infrastructure hardening gaps, including broad SPIRE VM ingress and sensitive bootstrap/configuration values in environment variables.

Acceptance criteria:

• Restrict SPIRE server ports to required VNet/subnet sources.
• Inventory sensitive Container App and azd values.
• Move long-lived secrets and trust material to Key Vault-backed storage where supported.
• Document rotation and emergency recovery.
• Verify full deployment and re-attestation after hardening.

Relevant files:

• infra/modules/spire-server-vm.bicep
• deploy.sh
• docs/runbooks/hard-won-learnings.md