Add DevBrain 2.0 ASP.NET Core host on Azure Container Apps

[dsghi]

Summary - add DevBrain.Server, a standalone .NET 10 ASP.NET Core MCP host using ModelContextProtocol.AspNetCore 2.1.0 and the 2026-07-28 MCP specification revision - extract shared Cosmos and OAuth behavior into DevBrain.Core while retaining the Azure Functions host for side-by-side compatibility - add Azure Container Apps and ACR infrastructure, managed-identity access, health probes, rate limits, DevBrain.User authorization, and a reprovision-safe azd workflow - update the public deployment, client, architecture, and compatibility documentation for DevBrain 2.0 - harden OAuth diagnostics so caller-controlled values cannot forge log entries or disclose OAuth secrets ## Why The Azure Functions MCP extension remains behind the current SDK and protocol behavior and does not let DevBrain own the complete MCP authentication challenge surface. The direct ASP.NET Core host provides current protocol support and standards-compliant OAuth challenges without removing the working Functions deployment during validation. ## Deployment safety - deploys beside the existing Functions host and reuses the existing Cosmos documents - isolates v2 OAuth records and Data Protection keys - defaults to zero minimum replicas and does not require Redis, Front Door, or a custom domain - retries the first managed-identity Cosmos role assignment during Entra propagation - preserves the deployed private image during later infrastructure-only provisions - removes the obsolete one-shot ops/touch endpoint and legacy seed script ## CodeQL disposition - Fixed 16 actionable log-forging flows by replacing raw caller-controlled OAuth fields with fixed-length SHA-256 fingerprints or bounded structural flags. - Alerts #11, #12, and #20 traced values that are server-generated and reachable only after successful validation, so the reported injection path was not exploitable; those diagnostics were standardized to fingerprints anyway. - Alert #21 could not forge a log entry because the cleanup key is server-generated base64url data. The raw key and Cosmos exception message were still removed because some key types contain OAuth secrets and do not belong in logs. - Alerts #22 and #23 are false positives; the post-fix scan emitted #24 as a duplicate of #23 after line movement. The conditions require the exact OAuth constants response_type=code and code_challenge_method=S256 before calling a pure authorization-URI builder that receives only configured values and server-generated state/PKCE data. No caller-controlled authentication or authorization bypass exists; the alerts were dismissed with this rationale. - Added adversarial regression coverage for authorization, callback, registration, and token requests containing CR/LF injection payloads. ## Validation - 168 tests passed: 161 Functions/Core and 7 Server - format verification, release publish, Docker build, Bicep build, ARM validation, azd preview/provision/package, and dependency vulnerability audit passed - log-forging regression tests first failed against the original implementation and pass with the hardened diagnostics - live Container App provisioned successfully; managed-identity RBAC verified; health endpoint is healthy after reprovisioning - unified ChatGPT/Codex Windows app completed OAuth with DevBrain.User, discovered all 12 tools, and read existing shared Cosmos documents VS Code/Copilot and the remaining supported clients still need end-to-end validation before any separate decision to retire the Functions host.