Claude quota inspector, preflight, workspace-scoped az login, Foundry role rename

[achandmsft]

Heads up to reviewers

This PR was updated in commit fc84952 on top of the original d3a505e. The new commit changes role terminology — please review with these names in mind:

Old name (don't reintroduce)	Current name (Azure renamed)	Role GUID (unchanged)
Azure AI User	Foundry User	53ca6127-db72-4b80-b1b0-d745d6d5456d
Azure AI Project Manager	Foundry Project Manager	eadc314b-1a2d-4efa-be10-5d325db5065e

Azure quietly renamed both built-in roles. The GUIDs are stable. The Bicep variant always referenced by GUID, so it kept working but had stale variable names + comments. The Terraform variant referenced by literal name (role_definition_name = "Azure AI User") and is now a runtime-only failure (Role "Azure AI User" doesn't exist) — fixed here. README mentions all carry a "(formerly Azure AI User)" note for searchability.

---

Summary

Five related changes:

1. src/check_claude_quota.py — programmatic Claude quota + capacity inspector. Queries the Foundry Usages and Model Capacities ARM APIs (per the official docs) and prints a merged (model, region) table with TPM utilization, derived RPM limits, deployable capacity, and active model version. RPM is derived from documented per-model RPM:TPM ratios since RPM is not a separate quota line in the Usages API.

2. scripts/preflight-claude.{ps1,sh} — preprovision hook gating azd up on Marketplace catalog resolution + quota headroom. Both infra-bicep/azure.yaml and infra-terraform/azure.yaml now invoke the script instead of inlining a single CLAUDE_ORGANIZATION_NAME check.

3. Workspace-scoped az login — activators (claude-code.env.{ps1,sh}) and .vscode/settings.json (terminal.integrated.env.{windows,linux,osx}) now set AZURE_CONFIG_DIR=<repo>/.azure-cli. az login from this workspace writes its MSAL token cache + config to ./.azure-cli/ only — it never touches ~/.azure and never leaks into other VS Code windows. .azure-cli/ is added to .gitignore. Documented in a new "Workspace-scoped az login" callout in the README.

4. Role rename fix (see heads-up above). Bicep variable names + comments updated for clarity (GUIDs unchanged); Terraform role assignments renamed to the current names; all 6 README mentions updated; src/hello_claude_apikey.py docstring updated.

5. scripts/verify-claude-code.{ps1,sh} — one-command end-to-end verifier with 9 checks: activator file, env vars, deployed families, .vscode/settings.json shape, az account, Foundry resource reachable, Claude Code CLI on PATH, optional claude -p round-trip per family, optional Python SDK round-trip. Exits non-zero on hard failure so it can wire into CI. Referenced from the "Verify Claude Code is wired up" README section.

README also expands:

• New troubleshooting rows: soft-deleted Cognitive Services accounts holding TPM quota for 48h (with parallel purge recipe), intermittent 401 from data-plane RBAC propagation lag, Windows charmap codec on emoji, check_claude_quota.py needing AZURE_SUBSCRIPTION_ID.
• New "Free quota held by soft-deleted accounts" section.
• New "Granting data-plane roles after azd up" section with copy-paste PowerShell + bash one-liners (covers the case where ASSIGN_RBAC is left at its default false).
• New Advanced section documenting check_claude_quota.py (flags, requirements, output semantics).
• New Advanced section documenting the preflight preprovision hook.
• Default capacities lowered 50 -> 25 in both Bicep and Terraform so the defaults fit in a typical MSDN / PAYG 80 TPM quota with room for a second deployment.

Test plan

• check_claude_quota.py: ran against an EA subscription with active Claude deployments; verified TPM, derived RPM, and capacity numbers across eastus2 + swedencentral (and opportunistic regions like westus2 / westcentralus).
• Preflight: covered by the existing preprovision hook on both IaC variants; no change to azd up behavior beyond clearer early failure messages.
• Workspace-scoped az login: opened a second VS Code window outside the repo, confirmed az account show there is unaffected by az login inside this workspace; confirmed ./.azure-cli/ is populated and ~/.azure is untouched.
• Role rename: az bicep build succeeds with no new warnings; terraform init -backend=false && terraform validate reports Success! The configuration is valid.
• Verify script: verify-claude-code.ps1 -SkipClaudeCall reports 9/9 PASS against a live claude-foundry resource; full run with claude -p round-trip and Python SDK round-trip also passes.
• README: rendered locally; cross-links resolve.