[Incident][108dev] APIM/SWA integration regressions: CORS + configuration themes 500

## Summary
The 108dev environment experienced frontend/API integration regressions affecting demo readiness:
- Initial failure: CORS preflight blocked at APIM.
- Follow-up failure after CORS fix: GET /api/configuration/themes returning 500.

## Impact
- Frontend could not load configuration themes.
- Demo flow was blocked.

## Root Causes Identified
1. **APIM CORS policy drift**
- APIM policy did not allow the active SWA origin.
2. **Configuration service runtime misconfiguration**
- COSMOS_ENDPOINT, COSMOS_DATABASE, and COSMOS_CONFIGURATION_TABLE were empty in utor-configuration-108dev.
3. **Cosmos data-plane RBAC missing**
- Managed identity of utor-configuration-108dev lacked permissions (
eadMetadata forbidden).

## Live Fix Applied (already executed)
- Patched APIM CORS policies to allow current SWA origin.
- Updated Container App env vars on utor-configuration-108dev:
- COSMOS_ENDPOINT=https://tutor108dev4p86ctcosmos.documents.azure.com:443/
- COSMOS_DATABASE=tutor
- COSMOS_CONFIGURATION_TABLE=configuration
- Granted Cosmos DB built-in data role:
- Role: Cosmos DB Built-in Data Contributor
- Principal: configuration app managed identity
- Scope: Cosmos account

## Validation Evidence
- Preflight CORS requests succeeded (200 with allow-origin).
- GET https://tutor-108dev-apim.azure-api.net/api/configuration/themes returned 200.
- Response body: {"title":"Themes Retrieved","message":"Themes fetched","content":[]}
- Container app logs show /themes returning 200 OK after RBAC assignment.

## Next Steps (IaC hardening)
- [ ] Persist APIM CORS origin policy declaratively in IaC/workflow path.
- [ ] Ensure all required COSMOS_* env vars are set from infra outputs (not empty defaults).
- [ ] Add Cosmos SQL role assignment for service identities in IaC.
- [ ] Add post-deploy smoke test for /api/configuration/themes through APIM.
- [ ] Add drift detection/guardrail for APIM policies and Container App env vars.

## Tracking
This issue is the canonical reference for the IaC remediation PR(s).