Fix admin settings saves, Search checks, and Key Vault permissions

[Paul Lizer (paullizer)]

Why

Admin settings could fail after the Development/React V2 integration even when the Key Vault connection test reported success. This fixes the confirmed Search initialization and settings-revision regressions, and aligns vault diagnostics and deployment permissions with the application's actual secret-storage requirements.

Approach

• Restore the public Azure Search audience and automatic-repair logging, and keep Search failures visible without exposing provider details.
• Make unchanged index observations read-only. Sequence classic index checks and advance the form revision only through its own conditional metadata operation. Real concurrent edits remain conflicts, and queued submissions retain validation.
• Share a draft-aware Key Vault list/write/read-back/cleanup probe between classic and V2. Report permission and cleanup failures explicitly, prevent overlapping clicks, and surface safe secret-write errors during saves without plaintext fallback.
• Grant vault-scoped Key Vault Secrets Officer to the runtime identities through Bicep/generated ARM, Azure CLI, and Terraform. Preserve existing grants and the Bicep permissions-disabled option; reconcile existing CLI deployments and legacy access policies.
• Update setup/troubleshooting guidance and regression coverage, including the Azure Playwright fixture's correct Entra token audience.

Application version: 0.261.125. Deployer version: 1.0.32. Existing model APIs and Redis publication safeguards are unchanged.

Validation

Coverage	Result
Focused application/settings/model regressions	181 tests and 528 subtests passed
Route authentication and policy contracts	14 passed
UI and connection fixtures	18 passed, including 14 Azure-hosted browser scenarios
Documentation inventory and site quality	13 passed
Deployment contracts	7 tests and 33 subtests passed

Also verified fresh imports under normal and optimized Python, the V2 TypeScript/Vite build, JavaScript syntax, Bicep compilation, PowerShell parsing, and Terraform formatting/validation. Browser service outcomes are mocked; no live application settings or vault secrets were changed.

This is not an all-repository green-suite claim. Three unrelated SQL/MCP fixture cases were excluded from the focused run. A legacy model-alias browser selector failure and four older deployer test failures were also reproduced against unchanged/baseline code. Details are recorded in ADMIN_SETTINGS_POST_MERGE_REGRESSIONS_FIX.md; unrelated expectations were not rewritten.

Rollout considerations

• Existing manually assigned Officer grants need the documented Bicep GUID-adoption or Terraform import steps before rerunning infrastructure deployment. The CLI deployer reuses matching grants automatically. Do not delete existing grants or reuse a Secrets User assignment GUID.
• The connection test creates a uniquely named synthetic secret with a ten-minute expiry and deletes it. Cleanup uncertainty remains a failed test; soft-deleted metadata follows vault retention, and the test never purges secrets.
• Nothing was deployed to the live app. Release notes remain unchanged because approval was unavailable. No associated issue was requested.