ci(infra): apply per-environment tfvars via -var-file (fixes prod private topology)

[james-tn]

Summary

Fixes a latent bug in the Terraform deploy step: it passed only individual -var flags and never referenced prod.tfvars / dev.tfvars, so enable_networking and enable_private_endpoint silently fell back to their defaults (false). The pipeline therefore deployed a public topology even though both tfvars declare the intended private topology (VNet-integrated Container Apps env + Cosmos private endpoint, public access disabled).

Why this matters (root cause of the prod /chat 500s)

Production ended up in a broken half-state:

• A manual terraform apply -var-file=prod.tfvars had set Cosmos public_network_access = Disabled, but
• the Container Apps environment was created without VNet integration (which is immutable post-creation), so the backend egresses over the public internet and Cosmos's firewall rejects it.

Result: every /chat returns 500 (Forbidden ... blocked by your Cosmos DB account firewall settings), which is what's failing integration-tests on PRs to main (e.g. #426) — even though those PRs don't touch the deployed backend.

The change

Select the per-environment var file and pass it as -var-file (listed before the explicit -var flags so env/subscription/location/ACR/images/iteration still override the file):

case "<inputs.environment>" in
  production|prod) VAR_FILE="prod.tfvars" ;;
  *)               VAR_FILE="dev.tfvars" ;;
esac
TF_VARS=( -var-file=${VAR_FILE} -var project_name=... )

⚠️ Deployment impact (read before merging/deploying)

Applying this to an environment whose Container Apps env was created without a VNet will force-replace that environment (VNet integration is immutable), which recreates the contained Container Apps → brief backend/MCP downtime. This also creates the VNet/subnets and the Cosmos private endpoint. Plan and redeploy during a maintenance window.

Both dev.tfvars and prod.tfvars are internally consistent (enable_networking=true + enable_private_endpoint=true), so per-developer integration-* environments will likewise deploy the private topology on their next run.

Related

• PR ci: harden & speed up workflows (concurrency, caching, timeouts, unit lane, resilient integration tests) #428 (advisory integration tests) prevents this class of environmental breakage from blocking unrelated PRs to main.