Fix deployment issues for TTYD

[René Schumacher (ReneSchumacher)]

The following issues we found and fixed

Local-testing blockers (script robustness):

1. Principal resolution threw an SP-only error for user logins → user fallback
2. -ApplicationId [Guid] argument-transformation error -EA couldn't catch → GUID guard
3. Poll loop .ProvisioningState crashed under Set-StrictMode → null guard

Production-breaking (would fail in the real console too):

4. -AsJob couldn't serialize the SecureString password → plain string
5. fabricAdminMembers collapsed to a scalar → forced array
6. Fabric capacity got object IDs instead of UPNs → resolve to UPNs
7. VNet redeploy hit ConflictWithNetworkIntentPolicy (SQL MI intent policies) → conditional/existing NSG+route table
8. Hand-rolled az rest Directory Readers grant → framework Set-MhhManagedIdentityRoleMember
9. Entra-token SQL auth needed an Entra admin the platform can't set → SQL auth + drop the admin step
10. Microsoft.PowerPlatform provider unregistered → added to $RequiredProviders
11. main.bicep location had no default → resourceGroup().location
12. External-provider logins failed (Msg 33134) — Entra auth wasn't enabled → declarative AAD admin (child resource, explicit sid) so ARM sets it without the imperative resolution wall

The standout is the # 9→# 12 arc: the platform can't set a SQL MI Entra admin imperatively, so we moved to SQL auth for the scripts and enabled Entra auth declaratively via the MI's administrators child resource — which is exactly the platform-friendly path you steered me toward.