Add Azure App Service backend deployment workflow for demo environments

[Copilot]

Current CI/CD only deploys static landing assets, leaving no reproducible deployment path for the FastAPI backend used in demos. This PR adds a dedicated backend deployment workflow with main/manual triggers, App Service deployment, health-gated rollout, and operator documentation.

• Workflow: backend build → publish → deploy

  • Added .github/workflows/deploy-backend-demo.yml.
  • Triggers on:
    • push to main
    • workflow_dispatch with operator inputs (environment, app_service_name, health_check_base_url, health_check_path).
  • Job structure:
    • build: Python setup + dependency install + compile validation.
    • publish: package backend artifact (backend-app.zip) and upload artifact.
    • deploy: OIDC Azure login + azure/webapps-deploy.

• Deployment target + config resolution

  • Deploys to Azure App Service using resolved app name with explicit precedence:
    1. manual app_service_name input
    2. BACKEND_APP_SERVICE_NAME variable (environment/repo scope)

• Post-deploy smoke check (fail-closed)

  • Performs HTTP health probe after deploy.
  • Normalizes health path input and validates:
    • transport success
    • HTTP 2xx status
    • valid JSON payload
    • healthy status contract (result.status or fallback overall)
  • Emits actionable failure diagnostics for operators.

• Docs: required config + rollback runbook

  • Updated docs/README.md with:
    • required Azure OIDC configuration (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, BACKEND_APP_SERVICE_NAME)
    • manual dispatch inputs
    • smoke-check behavior
    • rollback guidance via last known-good commit + same target environment.

- name: Smoke check backend health endpoint
  run: |
    NORMALIZED_HEALTH_PATH="${HEALTH_PATH#/}"
    HEALTH_URL="${BASE_URL%/}/${NORMALIZED_HEALTH_PATH}"
    HTTP_STATUS="$(curl --silent --show-error --location \
      --retry 5 --retry-delay 5 \
      --output /tmp/health-response.json \
      --write-out '%{http_code}' "$HEALTH_URL")"
    [ "$HTTP_STATUS" -ge 200 ] && [ "$HTTP_STATUS" -lt 300 ]