fix: use Log Analytics API for delegated consent

[Paulo Lacerda (placerda)]

Summary

• use the actual Log Analytics API resource app (ca7f3f0b-7d91-482c-8e09-c5d840d0eac5) during hosted Cockpit consent preflight
• preserve delegated scope resolution by value for the exact Data.Read grant
• add regression coverage for the corrected resource and delegated scope

Context

A real Entra consent attempt for issue #433 failed because the previous resource app ID did not resolve to the Log Analytics API in the tenant. Tenant discovery and Microsoft documentation identify the corrected resource app ID. Tenant admin consent remains an external prerequisite.

Validation

• python -m pytest tests/unit/test_cockpit_deployment_preview.py -q (77 passed)
• python -m pytest tests/ -x -q (1886 passed, 1 skipped)
• Ruff on changed files passed; repository-wide Ruff reports two unrelated pre-existing E2E/script findings
• mypy on the changed service passed; repository-wide mypy reports four unrelated pre-existing cloud_runner.py errors
• all repository Bicep files compiled successfully
• git diff --check passed