Fabric Eventhouse ingestion fails with private storage account firewall

🐛 Problem

When deploying FinOps Hub v13 with Fabric Eventhouse and a storage account with firewall enabled (public access disabled), ingestion fails because Fabric Eventhouse cannot read parquet files from the storage account.

The root cause is that ADF sends a .ingest into table KQL command with an abfss:// URI, which tells the Fabric Eventhouse to pull data from blob storage. Unlike ADX (which uses managed_identity=system), the Fabric path uses impersonate authentication. The storage firewall's "Allow trusted Microsoft services" bypass does not cover Fabric Eventhouse in this scenario.

Relevant code in Analytics/app.bicep:

.ingest into table ... ("abfss://ingestion@{storage}.dfs.{suffix}/...;impersonate")

For ADX, managed_identity=system is used instead, which works with the trusted services bypass.

👣 Repro steps

1. Deploy FinOps Hub v13 with Fabric Eventhouse (fabricQueryUri set)
2. Set enablePublicAccess = false (or manually configure storage firewall to "Selected networks" with trusted services bypass)
3. Wait for ADF pipeline to trigger on a cost export
4. Observe that the Fabric Eventhouse ingestion fails because it cannot read from the storage account

🤔 Expected

Ingestion should work with a firewalled storage account when using Fabric Eventhouse, the same way it works with ADX.

🔧 Environment

• FinOps hub version: 13.0
• Billing account type: N/A
• Power BI report type: N/A
• Cost Management export: N/A

ℹ️ Additional context

Reported in discussion #2058.

Start in Analytics/app.bicep by comparing the Fabric Eventhouse and ADX ingestion commands, then trace the ADF pipeline that issues the KQL command. Reproduce the deployment with public storage access disabled and verify that Fabric Eventhouse can ingest the parquet files from the firewalled storage account.