[Incident][108dev] Avatar speech token broker unavailable (missing speech/AI runtime config)

## Summary
Avatar speech and response flows are degraded in 108dev due to missing runtime configuration.

## Evidence
- `GET /api/avatar/speech/session-token` returns `503`
- Response detail:
- `Speech token broker unavailable: Speech broker is not configured. Set SPEECH_RESOURCE_ID and SPEECH_REGION.`
- Runtime env on `tutor-avatar-108dev` shows empty:
- `SPEECH_RESOURCE_ID`
- `SPEECH_REGION`
- `PROJECT_ENDPOINT`
- `MODEL_DEPLOYMENT_NAME`
- `GET /api/avatar/health` and `/ready` return `200` (service up but partially broken)
- Container Apps specialist found candidate AI/Speech resource in RG:
- `/subscriptions/150e82e8-25db-4f1a-8e04-a2f6a77d26c4/resourceGroups/tutor-108dev/providers/Microsoft.CognitiveServices/accounts/tutor108dev4p86ctai`
- region `westus3`

## Impact
- Speech token brokering fails for Avatar UI.
- Avatar conversational path is at risk due empty AI endpoint/deployment config.

## Proposed remediation
1. Set `SPEECH_RESOURCE_ID` + `SPEECH_REGION` on avatar app.
2. Set `PROJECT_ENDPOINT` + `MODEL_DEPLOYMENT_NAME` on avatar app.
3. Add deploy guardrail checks for these required vars.
4. Add post-deploy avatar smoke checks (`/speech/session-token`, `/response`).