F-13 [Medium] Terraform `azurerm ~> 3.x` blocks sticky sessions — SignalR breaks at >1 replica

## Summary\n\nThe Terraform `azurerm` provider is pinned to `~> 3.x` (`infra/terraform/main.tf`). This version cannot configure sticky sessions for Azure Container Apps. An inline comment acknowledges the gap. When the app scales beyond 1 replica, SignalR connections break because requests are not pinned to the instance holding the connection.\n\nThe required manual post-deploy step (`az containerapp ingress sticky-sessions set`) is **not documented** in the CD pipeline.\n\n## Affected Files\n\n- `infra/terraform/main.tf` — ingress comment + `required_providers`\n\n## Impact\n\nSignalR is broken in any multi-replica deployment. The workaround is undocumented and not automated.\n\n## Fix\n\n- Upgrade to `azurerm ~> 4.0` which supports sticky sessions via Terraform, **or**\n- Add `az containerapp ingress sticky-sessions set` as an explicit step in the CD workflow with documentation.\n\n## References\n\n- Audit artifact: `spin-agent-full-audit.md` (project artifact 1e910fcc580a4cb0)\n- Auditor: Thor

Start with infra/terraform/main.tf, including the azurerm required_providers constraint and the inline ingress comment. Check whether the provider upgrade supports sticky sessions; otherwise locate the CD workflow and review the az containerapp ingress sticky-sessions set command. Done means multi-replica SignalR deployments retain connections and the workaround or Terraform configuration is documented.

Written by the indexing model from the issue text.