[Sprint 2] Extract stacks/data-ai/ — Cosmos DB + AI Foundry

Start by comparing infra/terraform/main.tf with the requested files under infra/terraform/stacks/data-ai/. Run terraform state list | grep ai_foundry to enumerate AVM-managed resources, then review the state-migration and removed-block requirements. Done means both stacks plan with 0 changes, the 14 Cosmos containers remain intact, and the private endpoint and AI Foundry outputs work independently.

Summary

Extract Cosmos DB (account, database, containers, private endpoint) and AI Foundry (AVM module) from infra/terraform/main.tf into a new stacked root module at infra/terraform/stacks/data-ai/.

Parent epic: #119

Business Context

The AI Foundry AVM module (Cognitive Services + Hub + Project + 2 model deployments) can take 20–30 minutes on first deployment. Cosmos DB provisioning with private endpoint adds another ~5 min. Currently these compete with ACA app creation for control-plane quota in the same terraform apply. Isolating them allows:

• Parallel provisioning with ACA apps (both depend only on foundation)
• Independent retry on Foundry 409 RequestConflict errors (#117)
• Reduced blast radius — Foundry failure doesn't block ACA app creation

Scope

Resources to extract

Stay in foundation (shared VNet resources):

• azurerm_private_dns_zone.cosmos
• azurerm_private_dns_zone_virtual_network_link.cosmos

Files to create

• infra/terraform/stacks/data-ai/main.tf
• infra/terraform/stacks/data-ai/variables.tf
• infra/terraform/stacks/data-ai/outputs.tf — cosmos_endpoint, cosmos_database_name, ai_foundry_id, project_endpoint, model_deployment_name, model_reasoning_deployment, ai_services_endpoint
• infra/terraform/stacks/data-ai/providers.tf

State migration

High risk — the AI Foundry AVM module manages ~8 internal resources. Migration steps:

1. terraform state list | grep ai_foundry to enumerate all AVM-managed addresses
2. terraform state mv each resource from monolith → data-ai state
3. Do the same for all Cosmos resources + private endpoint
4. Validate with terraform plan on both stacks — expect 0 changes

Input Variables

Acceptance Criteria

• terraform plan on stacks/data-ai/ shows 0 changes after state migration
• terraform plan on foundation shows 0 changes after resource removal
• Cosmos DB private endpoint resolves correctly through foundation VNet
• AI Foundry model deployments are accessible from ACA apps
• Cosmos containers match production schema (14 containers)
• Stack is independently terraform plan-able for drift detection

Risk