[P1] Automate Entra/app configuration for self-serve token issuance

[simonholmes001]

Parent epic: #451

Objective

Automate identity provider/app configuration needed for self-serve onboarding.

Scope

• Configure token issuance for public/self-serve users
• Ensure issuer/audience compatibility with Agon backend validation
• IaC/secrets/workflow updates for reproducible environments

Acceptance criteria

• Non-manual app/tenant configuration path exists
• Environment deployment docs + automation are updated
• Backend validates self-serve issued tokens correctly