Issue-50: Provision Isolated QA Environments for Pull Requests

[klondikemarlen]

Fixes #50

Context

Pull request QA currently requires ad hoc deployment of a production-like build and manual cleanup. This adds a disposable, isolated environment workflow that can be operated locally without changing production deployment behavior or the caller's checkout.

Implementation

1. Create, update, inspect, tail logs from, and tear down a QA environment for a pull request.
2. Build and deploy the exact GitHub PR commit with immutable image and stable PR-scoped resource names.
3. Run SQL Server, Redis, and MailDev as disposable sidecars with non-production credentials and per-PR blob storage SAS.
4. Verify Auth0 wildcard configuration and application readiness before reporting the environment URL.
5. Persist local lifecycle state, retain failed cleanup for retry, and require explicit confirmation for --all teardown.
6. Guard Azure resource scope, subscriptions, tags, storage account ownership, production-looking names, and existing app ownership.
7. Document prerequisites, Auth0 values, limits, TTL responsibility, naming, and cleanup behavior.
8. Route the temporary deployment CLI through the shared service call pattern.

Screenshots

N/A - backend and developer tooling changes only.

Testing Instructions

1. Run the test suite via dev test.
2. Boot the app via dev up.
3. Log in to the app at http://localhost:3000.
4. Run this local deployment command smoke check:
   set -eu; ruby -c bin/lib/deploy/temporary/support/service.rb; ruby -c bin/lib/deploy/temporary/command.rb; ruby -c bin/deploy; bin/deploy temporary --help; bin/deploy ephemeral --help
5. Run bin/dev test api and bin/dev test web through the documented Docker wrapper.
6. Run bin/dev check-types.
7. Configure the documented local-only TEMPORARY_DEPLOYMENT_* values, then run bin/deploy temporary up --pr <number> and verify the reported URL, SHA, readiness response, status, logs, and explicit teardown command.
8. Run bin/deploy temporary down --pr <number> and verify the remote app, blob container, and PR image are removed; use bin/deploy temporary down --all --yes only when intentionally cleaning every tracked temporary deployment.

Observed verification before the focused scope restoration: Ruby syntax checks, deployment formatter and command-help checks, canonical temporary configuration smoke test, API lint, web lint, API type checks, full API tests (23 files/122 tests), web tests (1 file/14 tests), API/web type checks, local production Docker build with temporary arguments, and git diff --check passed. The four unrelated lint-cleanup files were restored as requested. The deployment command smoke check remains a manual QA step because this environment's repository boundary blocks executing bin/deploy. Real Azure/Auth0 provisioning remains operator-dependent because no QA subscription or management token is available in this environment.

Learner coverage: no action; this feature is based on a manually requested external-project review, not a repeatable learner miss.