Automated Key Vault provisioning and secrets management

## Description

Deployed resources often require secrets (connection strings, API keys). Git-ape's `copilot-instructions.md` mentions Key Vault references (`@Microsoft.KeyVault(...)`) but there's no automated Key Vault provisioning or secrets wiring in the template generator.

## Scope

1. **Auto-provision Key Vault** — When a deployment includes resources that need secrets, auto-include a Key Vault in the template.
2. **Key Vault references** — All app settings that contain secrets use `@Microsoft.KeyVault(...)` references instead of inline values.
3. **Secrets rotation guidance** — Post-deployment runbook section on secrets rotation.
4. **Managed identity access** — Auto-configure managed identity access policies on the Key Vault.

## Acceptance Criteria

- [ ] Deployments with secret-consuming resources auto-include Key Vault.
- [ ] App settings use Key Vault references.
- [ ] Managed identity access to Key Vault is configured.
- [ ] Secrets rotation guidance included in post-deployment documentation.