fix: remove Container App IP restrictions, use application-layer proxy control

Container App IP restrictions block the frontend App Service proxy
traffic since the CAE is external. Instead, rely on the application-
layer approach: the /config endpoint returns same-origin /api URL in
WAF mode, so browsers never see the Container App URL. The proxy in
frontend_server.py handles all /api/* routing server-side.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Prajwal-Microsoft

infra/main.bicep

@@ -1192,14 +1192,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
     managedIdentities: { userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId] }
     ingressTargetPort: 8000
     ingressExternal: true
-    ipSecurityRestrictions: enablePrivateNetworking ? [
-      {
-        name: 'allow-vnet-only'
-        action: 'Allow'
-        ipAddressRange: '10.0.0.0/8'
-        description: 'Allow VNet traffic only'
-      }
-    ] : []
     activeRevisionsMode: 'Single'
     corsPolicy: {
       allowedOrigins: [
@@ -1408,14 +1400,6 @@ module containerAppMcp 'br/public:avm/res/app/container-app:0.18.1' = {
     managedIdentities: { userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId] }
     ingressTargetPort: 9000
     ingressExternal: true
-    ipSecurityRestrictions: enablePrivateNetworking ? [
-      {
-        name: 'allow-vnet-only'
-        action: 'Allow'
-        ipAddressRange: '10.0.0.0/8'
-        description: 'Allow VNet traffic only'
-      }
-    ] : []
     activeRevisionsMode: 'Single'
     corsPolicy: {
       allowedOrigins: [

infra/main_custom.bicep

@@ -1219,14 +1219,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
     managedIdentities: { userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId] }
     ingressTargetPort: 8000
     ingressExternal: true
-    ipSecurityRestrictions: enablePrivateNetworking ? [
-      {
-        name: 'allow-vnet-only'
-        action: 'Allow'
-        ipAddressRange: '10.0.0.0/8'
-        description: 'Allow VNet traffic only'
-      }
-    ] : []
     activeRevisionsMode: 'Single'
     corsPolicy: {
       allowedOrigins: [
@@ -1450,14 +1442,6 @@ module containerAppMcp 'br/public:avm/res/app/container-app:0.18.1' = {
     managedIdentities: { userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId] }
     ingressTargetPort: 9000
     ingressExternal: true
-    ipSecurityRestrictions: enablePrivateNetworking ? [
-      {
-        name: 'allow-vnet-only'
-        action: 'Allow'
-        ipAddressRange: '10.0.0.0/8'
-        description: 'Allow VNet traffic only'
-      }
-    ] : []
     activeRevisionsMode: 'Single'
     corsPolicy: {
       allowedOrigins: [