docs(site): add prod SWA + OIDC deploy + /docs base path

[takyyon]

Summary

Stands up a production Azure Static Web App for the docs site and reworks the
deploy pipeline so it actually runs end-to-end again. After this PR plus a
small amount of out-of-band setup (see Post-merge follow-ups below), the
docs will be served from https://auto.azure.com/docs/ behind Azure Front
Door.

Closes the issue where the docs link in the portal pointed at the raw
canary SWA hostname (https://lemon-mud-…azurestaticapps.net).

What changed

New prod infrastructure (already provisioned)

	Canary (existing)	Prod (new)
Resource group	otto-docs-canary-rg	otto-docs-rg
Static Web App	otto-docs-canary-swa	otto-docs-swa
Hostname	lemon-mud-0e10bdd1e.7.azurestaticapps.net	kind-river-0d9e9ac1e.7.azurestaticapps.net
Public URL	(same as hostname)	https://auto.azure.com/docs/ via AFD
SKU	Free	Free

Both run in westus2 in the existing Logic Apps subscription. The new RG
is tagged environment=prod project=otto-docs.

Workflow rewrite — /.github/workflows/docs-site-deploy.yml

Replaces a workflow that was failing on every run since May 27
("deployment_token was not provided", because the secret it referenced
didn't exist) with a 4-job pipeline that authenticates via OIDC and
fetches deployment tokens just-in-time:

• build — single Astro build, uploaded once as an artifact.
• deploy_canary — auto on push to main, on in-repo PRs (preview
  environment), and on manual dispatch with target=canary (restricted
  to main to match federated cred coverage).
• deploy_prod — workflow_dispatch only with target=prod. Gated
  by a docs-prod GitHub environment so prod never deploys without a
  reviewer's click.
• close_pr_preview — tears down preview environments when same-repo
  PRs close.

Fork PRs build but don't deploy (GitHub doesn't pass secrets to fork
workflows — by design). A preflight step fails fast with a clear error
message if the required Azure secrets aren't set.

Astro reconfigured for /docs base path

To serve cleanly behind an AFD route, the site is now built with:

• base: '/docs' — Astro emits links and asset URLs under /docs/….
• outDir: './dist/docs' — file paths on disk match URL paths in HTML.
• A small remark plugin (scripts/remarkBasePrefix.mjs) prepends
  /docs to plain markdown links so content stays portable.
• A postbuild script (scripts/postbuild.mjs) hoists
  staticwebapp.config.json back to the dist root (where SWA requires
  it) after astro build.

The canary hostname keeps working because staticwebapp.config.json
adds / → /docs/ and /docs → /docs/ 301 redirects, plus a
navigationFallback rewrite to /docs/404.html.

Content

• Replaced otto.azure.com with auto.azure.com in 5 doc pages
  (introduction.md, setup.md, permissions.md, workflows.md, and
  inline references). The otto.azure.com domain is being decommissioned.

INFRA.md

Fully rewritten with the canary + prod resource map, the OIDC auth flow,
disaster-recovery az commands for re-provisioning everything from
scratch, and the one-time repo configuration that has to happen out of
band.

How auth works now (no stored deploy tokens)

GitHub Actions OIDC token
        │
        ▼
azure/login@v2 (federated credential trust)
        │
        ▼
Azure access token for "Otto E2E GitHub Actions" SP
        │
        ▼
az staticwebapp secrets list  ← JIT-fetch deploy token (masked in logs)
        │
        ▼
Azure/static-web-apps-deploy@v1 (upload)

Federated credentials trusted by the SP (already configured):

Subject	Used by
repo:Azure/Logic-Apps-Automation:ref:refs/heads/main	push to main + manual canary
repo:Azure/Logic-Apps-Automation:pull_request	in-repo PR previews
repo:Azure/Logic-Apps-Automation:environment:docs-prod	gated prod deploys

To rotate a deployment token (or after a suspected leak), run
az staticwebapp secrets reset-api-key … — no workflow or secret change
is needed.

Files changed

• .github/workflows/docs-site-deploy.yml — rewritten
• docs-site/astro.config.mjs — base, outDir, remark plugin
• docs-site/package.json — build now runs postbuild script; added unist-util-visit
• docs-site/scripts/postbuild.mjs (new)
• docs-site/scripts/remarkBasePrefix.mjs (new)
• docs-site/staticwebapp.config.json — moved out of public/; new redirects + headers
• docs-site/INFRA.md — fully rewritten
• docs-site/README.md — updated tree + URL refs
• docs-site/src/components/Video.astro — fixed a stale JSDoc example
• docs-site/src/content/docs/index.mdx — hero link: frontmatter prefixed
• docs-site/src/content/docs/demos/index.mdx — LinkCard uses BASE_URL
• 4 content pages — otto.azure.com → auto.azure.com

Testing

• npm ci — clean install.
• npm run check — 0 errors / 0 warnings / 0 hints across 6 Astro files.
• npm run build — 21 pages built, 5.5 MB output.
• Verified asset URLs (/docs/_astro/*), favicon (/docs/favicon.svg),
  markdown links, and LinkCard hrefs all resolve to real files in the
  dist/ tree.
• actionlint — clean on the new workflow.