fix: fix the WAF issue and updated the docs

docs/ADR/003-reasoning-model-for-orchestrator-manager.md

@@ -111,4 +111,4 @@ manager_agent = Agent(manager_chat_client, name="MagenticManager")
 
 ## Superseded (2026-07-09)
 
-The reasoning/orchestrator model migrated from `o4-mini` to `gpt-5-mini` because `o4-mini` is deprecated (retires 2026-10-16). Because `gpt-5-mini` reasons by default, it preserves the structured-routing reliability that motivated this decision while consolidating the accelerator onto a single generally available model. The `ORCHESTRATOR_MODEL_NAME` config and the separate manager `FoundryChatClient` described above remain unchanged; only the default model value moved to `gpt-5-mini`. The historical decision text above is retained for context.
+The reasoning/orchestrator model migrated from `o4-mini` to `gpt-5.4-mini` because `o4-mini` is deprecated (retires 2026-10-16). Because `gpt-5.4-mini` reasons by default, it preserves the structured-routing reliability that motivated this decision while consolidating the accelerator onto a single generally available model. The `ORCHESTRATOR_MODEL_NAME` config and the separate manager `FoundryChatClient` described above remain unchanged; only the default model value moved to `gpt-5.4-mini`. The historical decision text above is retained for context.

infra/avm/main.bicep

@@ -1383,13 +1383,14 @@ module webSite './modules/compute/app-service.bicep' = {
     appSettings: {
       SCM_DO_BUILD_DURING_DEPLOYMENT: 'true'
       DOCKER_REGISTRY_SERVER_URL: 'https://${acrLoginServer}'
-      WEBSITES_PORT: '3000'
       WEBSITES_CONTAINER_START_TIME_LIMIT: '1800'
       BACKEND_API_URL: 'https://${containerApp.outputs.fqdn}'
       AUTH_ENABLED: 'false'
       PROXY_API_REQUESTS: enablePrivateNetworking ? 'true' : 'false'
     }
     virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webserverfarmSubnetResourceId : ''
+    vnetRouteAllEnabled: enablePrivateNetworking
+    imagePullTraffic: enablePrivateNetworking
     publicNetworkAccess: 'Enabled'
     diagnosticSettings: monitoringDiagnosticSettings
     applicationInsightResourceId: enableMonitoring ? app_insights!.outputs.resourceId : ''

infra/bicep/main.bicep

@@ -800,8 +800,7 @@ module frontend_app './modules/compute/app-service.bicep' = {
     appCommandLine: ''
     appSettings: {
       SCM_DO_BUILD_DURING_DEPLOYMENT: 'true'
-      DOCKER_REGISTRY_SERVER_URL: 'https://${acrLoginServer}'
-      WEBSITES_PORT: '3000'
+      DOCKER_REGISTRY_SERVER_URL: 'https://${acrLoginServer}'      
       WEBSITES_CONTAINER_START_TIME_LIMIT: '1800'
       BACKEND_API_URL: 'https://${backend_container_app.outputs.fqdn}'
       AUTH_ENABLED: 'false'

infra/main.waf.parameters.json

@@ -90,13 +90,13 @@
       "value": "${AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT}"
     },
     "backendContainerImageTag": {
-      "value": "${AZURE_ENV_IMAGE_TAG=latest_v5}"
+      "value": "${AZURE_ENV_IMAGE_TAG}"
     },
     "frontendContainerImageTag": {
-      "value": "${AZURE_ENV_IMAGE_TAG=latest_v5}"
+      "value": "${AZURE_ENV_IMAGE_TAG}"
     },
     "MCPContainerImageTag": {
-      "value": "${AZURE_ENV_IMAGE_TAG=latest_v5}"
+      "value": "${AZURE_ENV_IMAGE_TAG}"
     }
   }
 }