Entra ID authentication integration

[troyscott]

Description

Integrate Microsoft Entra ID (Azure AD) authentication with the FastAPI app.

Approach

Two layers:

1. Easy Auth — Azure App Service built-in auth (handles login flow, token validation)
2. App-level — FastAPI reads the X-MS-TOKEN-AAD-ID-TOKEN header injected by Easy Auth

Features

• Login/logout flow via Easy Auth
• Current user info displayed in header
• Role-based access (optional, via Entra app roles)
• Local dev: mock auth middleware for testing without Azure

Acceptance criteria

• Easy Auth configured via az CLI script (extend App Service provisioning script (FastAPI) #4)
• FastAPI middleware extracts user from Easy Auth headers
• User name/email displayed in app header
• Local dev works with mock auth
• Unauthorized requests redirected to login