Add managed identity to Cognitive Services (OpenAI) in Bicep deployment

Description:
Our Bicep infrastructure currently provisions Azure Cognitive Services (OpenAI) via `infra/app/openai.bicep` without a managed identity assigned.
PSRule for Azure baseline `Azure.AI.ManagedIdentity` requires that managed identities are enabled for AI resources when possible.
App Service and Azure Functions are already assigned managed identities, but OpenAI is not.

Acceptance Criteria:
- Add `identity: { type: 'SystemAssigned' }` to the `account` resource in `infra/app/openai.bicep`.
- Template remains deployable and backward compatible.
- No additional secrets are exposed or output.
- (Optional) Output the managed identity principal ID for downstream access control.

References:
- [PSRule for Azure: Azure.AI.ManagedIdentity](https://aka.ms/ps-rule-azdocs)

READY TO BE ASSIGNED TO COPILOT