Fix Video Indexer deployer region, app permissions, and settings erasure

[Paul Lizer (paullizer)]

Summary

Azure Video Indexer is not offered in every region, and the deployers had no way to place it anywhere but the app region, so deployVideoIndexerService=true failed the whole deployment in regions such as North Central US. Deployer-created accounts also never granted the App Service identity access to generateAccessToken, and postconfig.py blanked manually entered Video Indexer settings on every provision that did not deploy Video Indexer. The result was an AI Video Intelligence section stuck at Needs configuration with no account behind it.

• Region override: VIDEO_INDEXER_LOCATION / videoIndexerLocation (azd and Bicep), param_video_indexer_location (Terraform), and $param_VideoIndexerLocation (Azure CLI). They default to the app region. A different region also gets <appName><environment>vi, a Standard GPv2 storage account in the Video Indexer region. The azd preprovision hook now stops before provisioning and lists the supported regions when the target region lacks Video Indexer.
• App access: the App Service system-assigned identity gets Video Indexer Account Contributor in Azure Commercial and Contributor in Azure Government and custom clouds, regardless of authenticationType. In Bicep this lives in the new modules/setVideoIndexerPermissions.bicep, which also takes over the existing Video Indexer storage grant. The native Python app, Terraform, and the Azure CLI deployer (check-then-create) get the same grant.
• Settings: postconfig.py writes Video Indexer settings only when the deployment created the account, and uses the account's own region from the new var_videoIndexerLocation output.
• Terraform: reads the azapi 2.x output object directly instead of passing it through jsondecode(), and adds account name, ID, and region outputs for Admin Settings.

Notes for review:

• The least-privilege role in Azure Commercial also avoids RoleAssignmentExists for environments where admins already added Contributor by hand. In Azure Government and custom clouds the newer role is not confirmed, so Contributor is used. An existing manual Contributor grant at the account scope there must be adopted; the READMEs document this the same way as the Key Vault Officer change.
• The Video Indexer storage assignment moved modules, but its guid() inputs are unchanged, so existing deployments see a no-op.
• The dedicated storage uses publicNetworkAccess: Enabled with defaultAction: Deny under private networking. Video Indexer reaches firewalled storage as a trusted Azure service, which a disabled public endpoint would block. SimpleChat uploads video to the Video Indexer API and never reads this account, so it needs no private endpoint.
• An existing Video Indexer account cannot move regions; this is documented.
• main.json was regenerated with Bicep 0.44.1, the same version that generated the previous file.

Linked issue

Fixes #1666

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only (0.261.259 to 0.261.260)
• deployers/version.txt bumped, or not needed because deployers/ was not changed (1.0.32 to 1.0.33)

Testing / validation

• python functional_tests/test_video_indexer_deployment_region_permissions.py: passed, 10/10.
• python -m pytest functional_tests/test_video_indexer_deployment_region_permissions.py functional_tests/test_deployment_configuration.py functional_tests/test_azd_windows_hook_environment.py functional_tests/test_deployer_key_vault_secret_permissions.py functional_tests/test_postconfig_redis_cache_configuration.py: passed, 53 tests and 33 subtests. The two new postconfig tests fail when run against the previous postconfig.py, which confirms they cover the regression.
• Twelve related deployer and Video Indexer test files report the same 11 failures on a clean HEAD and on this branch, so none are new. They are pre-existing exact-version pins and checks unrelated to this change.
• az bicep build --file .\deployers\bicep\main.bicep --outfile .\deployers\bicep\main.json (Bicep 0.44.1): no errors or warnings. The changed modules also build cleanly on their own.
• terraform fmt -check: passed. terraform init -backend=false and terraform validate with Terraform 1.12.2 and the required providers: passed.
• PowerShell parser check of deployers/azurecli/deploy-simplechat.ps1: no errors.
• python functional_tests/test_docs_app_surface_coverage.py: passed, 7/7. python functional_tests/test_docs_site_quality.py: passed, 6/6. The regenerated docs inventory is unchanged.
• Live preflight against Azure: blocks northcentralus with the supported-region list, and passes with VIDEO_INDEXER_LOCATION=centralus.
• Applied the fixed modules to the affected North Central US environment. what-if showed only new resources. The deployment created the Video Indexer account in Central US with its same-region storage account and the app, storage, and Azure OpenAI role assignments. ARM generateAccessToken and a Video Indexer API call using the new account ID and centralus both succeeded.

Documentation

• Release notes updated, or not needed (v0.261.260 Bug Fixes entry)
• Feature documentation updated, or not needed (not needed; this is a fix)
• Fix documentation updated, or not needed (docs/explanation/fixes/VIDEO_INDEXER_DEPLOYMENT_REGION_AND_PERMISSIONS_FIX.md)

Also updated: deployers/bicep/README.md, deployers/terraform/ReadMe.md, docs/deploy/manual/provision-azure-resources.md, and docs/admin/knowledge.md.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (N/A: no routes changed)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (N/A: no frontend settings changes)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS (N/A: no browser JavaScript changes)
• No secrets, keys, connection strings, or local-only artifacts are included