fix: Reduce quota demand, add Bicep version guard, remove hardcoded VM credentials

[Roopan-Microsoft]

Summary

Addresses 3 high-impact findings from the Modernize-your-code error analysis (telemetry: 2025-12-01 to 2026-04-06). Template currently has 61.1% success rate (229 failures / 588 provisions).

---

Changes

1. Add Bicep version guard (P1 - addresses 43.2% of failures)

Error: \InvalidTemplate\ — 99 occurrences, 35 machines. The #1 error category.

• Added \�icep: '>= 0.33.0'\ to \
  equiredVersions\ in both \�zure.yaml\ and \�zure_custom.yaml\
• Why: Template uses Bicep 0.33+ features (\deployer()\, \
  esourceInput<>\, null-forgiving \!\) but only guarded azd version. Users with older Bicep get cryptic compile errors. Now azd fails fast with a clear message.

2. Reduce default model capacity (P1 - addresses 2.2% of failures)

Error: \InsufficientQuota\ — 5 occurrences, 2 machines

• \gptModelCapacity\: 150 -> 30 TPM (80% reduction)
• Added \@minValue(1)\ constraint
• Why: 150 TPM is excessive for a single-model template. Many subscriptions lack this quota. Template remains fully functional at 30 TPM.

3. Remove hardcoded VM credentials (SECURITY - OWASP A07:2021)

Issue: Hardcoded password \JumpboxAdminP@ssw0rd1234!\ visible in public repository

• Removed fallback defaults from \main.bicep\, \main_custom.bicep\, and \main.json\
• VM credentials now required when \�nablePrivateNetworking = true\ (fails fast if not provided)
• Updated \docs/DeploymentGuide.md\ and \docs/CustomizingAzdParameters.md\ accordingly

---

Files Changed (7 files)

File	Changes
\�zure.yaml\	Added Bicep version requirement
\�zure_custom.yaml\	Added Bicep version requirement
\infra/main.bicep\	Reduced capacity, removed hardcoded creds, improved param descriptions
\infra/main_custom.bicep\	Same fixes as main.bicep
\infra/main.json\	Compiled ARM template updated to match
\docs/CustomizingAzdParameters.md\	Updated defaults and descriptions
\docs/DeploymentGuide.md\	VM creds now required, not optional

Impact

• Projected success rate: 61.1% -> ~75-80%
• Security vulnerabilities fixed: 1 critical (hardcoded credentials)
• Zero breaking changes for non-WAF deployments