[patty-chow]

Summary

Make DocumentDB for VS Code the visual database explorer throughout the existing 105-minute workshop.

• Expose distinct Site A/B database endpoints on loopback only, with configurable ports. Keep only the private app port auto-forwarded; both devcontainer profiles ignore database/other port auto-forwarding.
• Add a private handoff helper using the existing .env: credential-free URIs for the extension's normal URI input, separate username/password for native-auth prompts. Owner-only output excluded from Git and Docker; no console secrets, cloud export, or credential rotation.
• Add a bounded read-only endpoint verifier: authenticated catalog reads and cross-site credential denial over TLS.
• Integrate actual saved Connections, session/favorite inspection, app-copy comparison, and index/migration refresh into the attendee/instructor guides; retain CLI fallback.
• Add prebound read-only query playground templates and clear warnings against creating a third extension-managed database or substituting Copy Collection for the app's selected copy.
• Isolate reconnect regression database ports from the new extension endpoints.

Verification

• 57 offline tests passed, one existing platform-only skip; 61 local docs links passed.
• Actual local stack: 216 sessions seeded per site, published loopback TLS/auth reads passed, counterpart credentials denied on both endpoints.
• Real database integration 2/2 passed.
• Reconnect regression and independent review results will be reconciled before merge.

Acceptance ownership

A fresh Codespace will be opened after merge and tested using actual extension GUI connections, document browsing, refresh after app writes, migration/index inspection, and playground execution. Installation or CLI port checks alone are not claimed as GUI acceptance. No changes to the user's current Codespace or Azure resources are included in this task.