[codex] Implement Azure Key Vault remote secret loading (stg)

[cgrpa]

Summary

• implement Terraform remote-secret contract for Azure Container Apps using Key Vault references
• add required secret contract inputs and fail-fast preconditions for missing/disabled secrets
• wire Container App managed identity to Key Vault Secrets User role
• add bootstrap/rotation script and Terraform runbook updates
• restrict user-secrets loading to Development and normalize environment-prefix behavior

Why

Implements issue #22 staging-first remote secret loading via Azure Key Vault with Terraform as source of truth.

Validation

• dotnet build src/dotnet/TheSexy6BotWorker/TheSexy6BotWorker.csproj
• terraform fmt on Terraform files
• integration tests not run