Use managed identity for verification Functions auth

[madebygps]

Summary

• replace the verification Function host key with API managed identity bearer tokens
• protect the verification Function App with Microsoft Entra App Service Authentication
• remove the direct Container App secret for the Function key

Validation

• prek run --all-files
• docker exec app uv run pytest tests/ -x --tb=short for API and shared package tests
• uv run python -c "import function_app"
• terraform fmt and Docker-based terraform validate
• Azure-backed terraform plan