feat(infra): add Azure Container Registry (acr.tf)

Basic SKU for demo; name auto-generated from random suffix if not
provided via var.acr_name. Admin disabled — workload identity used
for AKS pull access (role assignment added in aks.tf).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: raykao

infra/acr.tf

@@ -1 +1,8 @@
-# Azure Container Registry - see task dark-factory-9ho
+resource "azurerm_container_registry" "main" {
+  name                = local.acr_name
+  resource_group_name = azurerm_resource_group.main.name
+  location            = azurerm_resource_group.main.location
+  sku                 = "Basic"
+  admin_enabled       = false
+  tags                = var.tags
+}

infra/outputs.tf

@@ -15,7 +15,12 @@ output "get_credentials_command" {
 
 output "acr_login_server" {
   description = "ACR login server hostname"
-  value       = try(azurerm_container_registry.main.login_server, "")
+  value       = azurerm_container_registry.main.login_server
+}
+
+output "acr_id" {
+  description = "Resource ID of the Azure Container Registry (used for AKS role assignment)"
+  value       = azurerm_container_registry.main.id
 }
 
 output "uami_client_id" {