DTOSS-12832: Enable Application Insights telemetry for gateway services

[josielsouzanordcloud]

What

Enables application-level observability for the four gateway Python services (PACS, MWL, Upload, Relay Listener). The codebase already has src/telemetry.py wired up for Azure Monitor / OpenTelemetry — this PR provides the infrastructure and deployment plumbing to activate it.

Changes

Terraform

• Adds an Application Insights resource (ai-mbsgw-<env>-arc-uks) to arc-infra using the shared dtos-devops-templates/infrastructure/modules/app-insights module, workspace-linked to the existing Arc Log Analytics Workspace
• Surfaces app_insights_connection_string as a sensitive output through the arc-infra module and root module

Deploy pipeline

• deploy_arc_ring.sh fetches the connection string at deploy time via az monitor app-insights component show (same ARM credentials already in scope) and injects it into the .env payload sent to each VM
• APPLICATIONINSIGHTS_CONNECTION_STRING added to the .env block; AZURE_RELAY_KEY_NAME, AZURE_RELAY_SHARED_ACCESS_KEY, and CLOUD_API_TOKEN removed — all superseded by Managed Identity authentication
• Key Vault lookups for CLOUD_API_ENDPOINT and CLOUD_API_TOKEN removed; relay SAS key fetch removed
• CLOUD_API_ENDPOINT is now derived from a per-environment CLOUD_API_HOSTNAME variable (see below) — no Key Vault or pipeline variable needed
• deploy_stage.sh no longer derives or passes KV_NAME

Per-environment config

• CLOUD_API_HOSTNAME added to each infrastructure/environments/*/variables.sh, following the same pattern as dns_zone_name in dtos-manage-breast-screening:

Environment	Hostname
review	review.manage-breast-screening.non-live.screening.nhs.uk
dev	dev.manage-breast-screening.non-live.screening.nhs.uk
preprod	preprod.manage-breast-screening.nhs.uk
prod	manage-breast-screening.nhs.uk

Acceptance criteria

• Application Insights resource exists in arc-infra module, workspace-linked to the existing LAW
• Connection string is a module output
• deploy_arc_ring.sh injects APPLICATIONINSIGHTS_CONNECTION_STRING into the .env payload
• CLOUD_API_ENDPOINT sourced from per-environment config (no Key Vault lookup)
• CLOUD_API_TOKEN, AZURE_RELAY_KEY_NAME, AZURE_RELAY_SHARED_ACCESS_KEY removed from the deployment .env
• After deployment, all four gateway services emit traces/logs visible in App Insights Live Metrics or Logs blade