Harden landing zone defaults and CI

[Jamonygr]

Summary

• Adds RDP guardrails: blocks all-internet jumpbox RDP unless explicitly overridden and makes public LB RDP NAT opt-in.
• Hardens shared services toward private-first defaults for Key Vault, SQL, and Storage.
• Moves GitHub Actions Azure auth to OIDC, enforces security/policy gates, fixes state backup ordering, and avoids graph action workspace mutation.
• Adds a cheap-lab profile, cost email validation, post-deployment diagnostics, and Terraform-managed App Gateway backend wiring.
• Updates README/wiki setup guidance from client-secret JSON to OIDC and removes duplicate README diagrams.

Validation

• terraform init -backend=false
• terraform fmt -check -recursive -diff
• terraform validate -no-color

Notes

• go test ./... was not runnable locally because Go is not installed on this machine.
• This worktree still shows unrelated CRLF checkout noise after commit; those files were not staged or included in this PR.