[Feature]: ensure secrets are always stored as such for ACA (and other services)

### Problem

By default, copilot was planning to store secrets as normal envvars:
```
I'll store those for reference, but I need to make sure the secrets are stored securely in Azure (not as plain-text env vars in
the container app). Let me check the current setup and fix it.

● Read infra\modules\container-app.bicep
└ 79 lines read

● Read infra\main.bicep lines 67-100
└ 39 lines read

● The secrets are currently passed as plain-text env vars. Container Apps supports a secrets configuration section where secrets are
stored securely, then referenced from env vars. Let me fix both the Bicep and deploy with the actual values.

● Edit infra\modules\container-app.bicep (+2)

● Now update main.bicep to use secrets properly — sensitive values go in secrets, env vars reference them via secretRef:
```

### Desired Solution

Add instructions for ACA to always use secretRef for secrets or sensitive env vars.

### Alternatives and Workarounds

_No response_

### Impact

_No response_

### Additional Context

_No response_