deploy: add Agent ID User (AUID) demo under kubernetes-service/auid

[vj926]

Summary

Adds an Agent ID User (AUID) end-to-end sample under deploy/azure/kubernetes-service/auid/, parallel to the existing kubernetes-service/dev/ tutorial. Demonstrates the non-OBO complement: an Entra Agent Identity with its own first-class user object (microsoft.graph.agentUser) calling a downstream service as itself — no human in the loop.

What's in this PR

• backend/ — FastAPI broker that walks the full Blueprint -> Agent ID -> AUID FIC chain in pure Python (auid_flow.py: recipe 03.01-03.04).
• weather-agent/ — downstream FastAPI service that validates the AUID bearer token (idtyp=user, appid, iss, tid, aud, exp) and returns weather + claims.
• ui/index.html — chat UI with a static Acting as badge (Agent ID User UPN) and a live debug panel that renders each FIC step as it runs.
• scripts/ — PowerShell helpers: 00-preflight-check (verifies every Entra permission, scope, FIC, and oauth2PermissionGrant), 01-provision-agentic-user, 02-grant-agentic-user-consent, 03-test-token-chain.
• .claude/skills/deploy-auid-demo/ — skill with SKILL.md and PERMISSIONS.md (definitive list of required permissions/scopes/FICs/grants).
• README.md — OBO vs AUID comparison, architecture diagram, quickstart, validation notes.

Conventions followed

• Folder layout matches sibling kubernetes-service/dev/ from Add deploy-agent-aks-agentid + teardown-agent-aks-agentid skills (Entra SDK auth-sidecar on AKS) #28.
• Skill folder layout matches existing deploy-agent-* skills.
• Reuses the same Blueprint + Agent Identity app registrations as the OBO AKS demo.

Notes for reviewers

• AUID token here targets scope=https://graph.microsoft.com/.default; weather-agent does strict claim-based validation (Graph tokens carry a nonce header that prevents third-party signature verification). For full RS256 verification, register a dedicated weather app and set WEATHER_AGENT_APP_ID in .env — documented in the README and PERMISSIONS.md.
• k8s/Helm chart mirroring the OBO AKS demo is planned as a follow-up; the local 3-tier stack already proves the flow end-to-end.

[vj926]

Withdrawing this PR. It predates the migration to the mcr.microsoft.com/entra-sdk/auth-sidecar pattern and posts directly to login.microsoftonline.com from the backend with a BLUEPRINT_CLIENT_SECRET. The replacement is #33, which delivers the same AUID demo as a self-contained sibling of deploy-agent-aks-dev (PR #28), uses the auth-sidecar with Workload Identity (no client secret in the cluster), and verifies the AUID JWT signature against the tenant JWKS in the Weather Agent.

Please redirect review to #33.