docs(azure): decide network & security baseline

[Garinlu]

Summary

• State-of-the-art for the Azure sprint's third ticket: CNI dataplane, exposure, cluster access, reference network, and Defender for Containers — builds on cluster mode and managed scope.
• CNI: self-managed Cilium via AKS's BYO CNI path, not the managed "Azure CNI powered by Cilium" — the managed variant gates FQDN filtering, L7 policies, and encryption behind a paid add-on (ACNS); self-managed gets the full feature set for free, at the cost of CNI issues falling outside Microsoft support.
• Exposure: Gateway API through the app routing add-on (in-cluster Istio, GA) by default — Application Gateway for Containers is also GA and richer (WAF, mTLS) but carries a real fixed cost (~$134/month minimum per Gateway), so it stays a catalog option.
• Cluster access: private cluster, public FQDN disabled — consistent with nodes already sitting in a private subnet, and cheap (~$7.30/month per cluster).
• Reference network: one VNet per environment, node-only subnet sizing (Cilium owns pod IPAM), NAT Gateway per environment.
• Microsoft Defender for Containers: catalog option, not default — never bundled into any AKS tier, billed per vCore (~$247/month across the reference estate), so it's a per-client packaging choice, not a module default.
• Clarifies scope: this module doesn't install Cilium itself, same as Karpenter/CSI/the load balancer controller on the other clouds — it's a factory component delivered through GitOps. The module only prepares the cluster for it.

Test plan

• Doc-only change — no code to test.
• Reviewed for the same structure and sourcing rules used across docs/aws/ and docs/gcp/.

🤖 Generated with Claude Code

[UlysseCarpentier]

LGTM, i don't know much about azure