[Knowledge] api-app: ## Advisory Notes — Stage 1: Managed Identity - **[Architec...

## Knowledge Contribution

**Type:** New service
**File:** `knowledge/services/api-app.md`
**Status:** NEW FILE — this knowledge file does not exist yet and must be created

### Context
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

- **[Security]** No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

### Rationale
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

- **[Security]** No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

### Content to Add
```
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permi
```

### Source
Build advisory review

### Required Knowledge File Sections
The new knowledge file MUST include ALL of these sections:
1. **Description** (one-line summary)
2. **When to Use** (scenarios and selection criteria)
3. **POC Defaults** (default SKU, tier, configuration)
4. **Terraform Patterns** (azapi_resource with RBAC)
5. **Bicep Patterns** (ARM template resources)
6. **Application Code** (Python, C#, Node.js — where applicable)
7. **Common Pitfalls** (deployment failures, misconfigurations)
8. **Production Backlog Items** (what changes for production)

Create knowledge/services/api-app.md as a new knowledge file, starting with the advisory notes and the Content to Add in the issue. Cover all eight required sections, including Terraform azapi_resource with RBAC, Bicep patterns, and applicable Python, C#, and Node.js guidance. Done means the file includes each named section and documents POC defaults, pitfalls, and production backlog items.

Written by the indexing model from the issue text.