Fix Terraform backend authentication to use OIDC instead of storage account keys

[Claude]

Terraform init was failing with KeyBasedAuthenticationNotPermitted because the Azure Storage Account has key-based authentication disabled, but Terraform defaulted to using storage account keys for backend access.

Changes

• CD workflow: Added -backend-config="use_oidc=true" to both terraform init commands (plan and apply jobs)
• CI workflow: Added terraform-plan job that runs on PRs using OIDC authentication
  • Gates on plan environment for OIDC federated credentials
  • Validates infrastructure changes before merge
  • Added id-token: write permission
• Documentation: Updated CONFIGURATION.md to document OIDC backend requirement

Backend Authentication

terraform init \
  -backend-config="resource_group_name=${{ secrets.BACKEND_RESOURCE_GROUP }}" \
  -backend-config="storage_account_name=${{ secrets.BACKEND_STORAGE_ACCOUNT }}" \
  -backend-config="container_name=${{ secrets.BACKEND_CONTAINER_NAME }}" \
  -backend-config="key=${{ secrets.BACKEND_KEY }}" \
  -backend-config="use_oidc=true"  # ← Uses GitHub OIDC token instead of storage keys

Terraform now authenticates to the backend using the service principal's Storage Blob Data Contributor role via OIDC, aligning with the repository's zero-key security posture.