Multi-subscription and multi-tenant deployment support

## Description

Enterprise deployments often span multiple subscriptions (hub-spoke, landing zones) and sometimes multiple tenants. Git-ape currently targets a single subscription per deployment.

Related: #14 (Landing Zone detection)

## Scope

1. **Multi-subscription templates** — Support cross-subscription resource group deployments.
2. **Hub-spoke networking** — Templates that deploy hub resources in one subscription and spoke resources in another.
3. **Multi-tenant OIDC** — Onboarding support for federated credentials across tenants.
4. **Subscription selector** — During requirements gathering, let users specify target subscriptions for different resource groups.

## Acceptance Criteria

- [ ] Deployment supports resources across 2+ subscriptions.
- [ ] Onboarding configures OIDC for multiple subscriptions.
- [ ] Hub-spoke networking pattern is supported.