Add Azure subscription and resource group resources to the app model

## Summary

Add `AddAzureSubscription` and `AddResourceGroup` APIs so an AppHost can explicitly model the Azure deployment hierarchy, including ambient, multi-subscription, global, regional, and stamp-specific resource placement.

## API shape and scenarios discussed

The following sketch was discussed in the meeting. The exact names and fluent API remain subject to design:

```csharp
// 3P scenario
var sub1 = builder.AddAzureSubscription("stuff"); // Would cause AppHost to select a subscription.
var sub2 = builder.AddAzureSubscription("stuff2");

var rg1 = sub1.AddResourceGroup("rg1"); // Adds a resource group associated with sub1.
var rg2 = sub2.AddResourceGroup("rg2"); // Adds a resource group associated with sub2.
var rg3 = builder.AddResourceGroup("rg3"); // Associated with ambient subscription.

var app = builder.AddProject(...)
.WithResourceGroup(rg1);

var app2 = builder.AddProject(...)
.WithResourceGroup(rg2)
.WithReference(app);

// eCommerce globally distributed
var globalSub = builder.AddAzureSubscription("globalsub");
var globalRg = globalSub.AddResourceGroup("globalrg");

// The global AFD parent resource
var afd = builder.AddAzureFrontDoor(...)
.WithResourceGroup(globalRg);

var app = builder.AddProject(...);
afd.WithOrigin(app);

// Azure RP using EV2
builder.AddEv2(...).WithStamps(...);

var globalSub = builder.AddAzureSubscription("globalsub");
var globalRg = globalSub.AddResourceGroup("globalrg");

var afd = builder.AddAzureFrontDoor(...)
.WithResourceGroup(globalRg);

var regionalSub = builder.AddAzureSubscription("regionalSub");
regionalSub.PerRegion();

var rprg = regionalSub.AddResourceGroup("rprg")
.PerRegion();

builder.AddAzureFrontDoor("frontdoor")
.WithOrigin(api)
.AsEnvironmentRegional()
.ConfigureInfrastructure(infrastructure =>
{
var origin = infrastructure.GetProvisionableResources()
.OfType()
.Single();

var region = infrastructure.GetOrAddAzureRegionParameter();
origin.Name = BicepFunction.Interpolate(
$"{origin.BicepIdentifier}-{region}");
});

var rp = builder.AddProject(...)
.WithResourceGroup(rprg)
.PerRegion();

afd.WithOrigin(rp); // How should this resolve correctly across regions?

var stampSub = builder.AddAzureSubscription("stampSub");
var stampWorkerRg = stampSub.AddResourceGroup("stampWorkerRg");

// The discussion continued with stamp-specific worker placement.
```

## Design goals

- Make subscriptions and resource groups first-class app-model resources.
- Let `AddAzureSubscription` select or resolve a subscription for deployment.
- Allow `subscription.AddResourceGroup(...)` to associate a resource group with that subscription.
- Allow `builder.AddResourceGroup(...)` to target the ambient subscription.
- Add `WithResourceGroup(...)` for assigning deployable resources to an explicit group.
- Support multiple subscriptions and resource groups in one application model, including references across them.
- Represent global, per-region, and per-stamp resources so a deployment provider such as EV2 can realize the model.
- Define how relationships such as a global Azure Front Door referencing regional origins expand and resolve across regions.

## Open design questions

- Are `PerRegion()` and the stamp equivalent annotations on the subscription, resource group, deployable resource, or some combination of them?
- How does a global resource reference the complete set of realized regional or stamped resources?
- Which resources are created versus selected/reused, and how are their identifiers supplied by each deployment provider?
- How should the same app model work for public Azure deployment and EV2 without exposing EV2-specific concepts in the general APIs?

_Created from a [Microsoft Teams conversation](https://teams.microsoft.com/l/message/19%3A5WmVWtYRZEPVV24RH7VliONLYxQhHosZSgL3t5GRO2c1%40thread.tacv2/1750790173828?tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47&groupId=f2e0b0b6-f130-46fa-8ec6-2ef4a7168ed2&parentMessageId=1750790173828)._

Start with the API sketch, design goals, and open design questions in this issue; no files, tests, or entry points are identified. Define the subscription, resource-group, regional, and stamp relationships, their reference-resolution behavior, and provider-neutral resource selection before implementation can be considered done.

Written by the indexing model from the issue text.