…prise app ownership

Automates the Gateway.Access app role assignment for Arc-enabled server
managed identities and ownership of the enterprise app spn-manbrs-web-api-<env>.

App role assignment is intentionally not automated via the Terraform pipeline.
Microsoft Graph requires AppRoleAssignment.ReadWrite.All in application auth
context to create app role assignments — service principal ownership is
insufficient. This permission is not permitted under the organisation's Entra
policy. Instead, assign_arc_app_roles.sh runs under delegated user credentials
(where SP ownership is sufficient) and is called automatically by
`make <env> resource-group-init`.

Changes:
- Arc machine managed identity app role assignment moved from Terraform
  (azuread_app_role_assignment) to scripts/bash/assign_arc_app_roles.sh,
  called as part of resource-group-init
- Bicep Graph extension manages pipeline MI and screening group members as
  owners of the enterprise app service principal and application registration
- Onboard Hospital VM runbook updated with Step 4 (Grant API access)
- Deployment pipeline and create-environment docs updated to explain the
  permission limitation and required manual steps