fix(iac/federation): azure-target Terraform bundle references a module outside the zip, so terraform init fails #1431

What happens

The Azure "Terraform bundle" download for federation onboarding cannot run terraform init as downloaded.

• iac/federation/azure-target/terraform/main.tf:70 loads its role module from outside the bundle: source = "../../../../terraform/modules/iam/azure/cudly-reservation-role".
• The server only embeds the iac/federation tree (iac/embed.go:9, //go:embed federation). addBundleTerraform (internal/api/handler_federation.go:666) zips only federation/azure-target/terraform from it. The module directory is never in the zip.
• With that folder on its own, terraform init fails with Unreadable module directory for module "cudly_reservation_role". This was reproduced locally while the decision was prepared; the code is unchanged on main at 6b586cc.

This has been broken since #744 (2026-05-27). #1295 and #1203 noted it as out of scope.

Impact

The UI lists "Terraform bundle" as the first download option for Azure. Customers who choose it cannot onboard that way. The CLI script, Bicep and ARM paths still work.

Suggested fix

Ship the role module inside the bundle:

• add terraform/modules/iam/azure/cudly-reservation-role to the zip (for example under modules/cudly-reservation-role/) and rewrite the source in the bundled main.tf; or
• keep a copy of the module beside the bundle under iac/federation, with a test that keeps it identical to the shared module.

Either way, keep scripts/check-azure-role-parity.sh and the module's other callers (terraform/environments/azure/ci-cd-permissions, the container-apps module) working.

Acceptance criteria

• A test generates every federation bundle, unzips it, and checks that every local module source resolves inside the zip.
• terraform init -backend=false and terraform validate pass on the unzipped Azure bundle, with no network access to the repo.
• The role definition in the bundle stays identical to terraform/modules/iam/azure/cudly-reservation-role (parity script or test).
• Applying a bundle in a real Azure subscription is for a human to confirm and is not part of CI.

Filed by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).