FEAT: Storage account creation for GUI deployments

[varunj-msft]

Description

Adds per-instance storage account creation to the GUI deployment script. Previously, deployed instances reused a shared AIRT storage account, breaking the isolation model. Each new instance now gets its own storage account and blob container, with the URL auto-injected into the .env (same pattern as the SQL connection string).

Changes:

• infra/deploy_instance.py — New create_storage_account() function. Grants Storage Blob Data Contributor on the new SA to the managed identity. Auto-injects AZURE_STORAGE_ACCOUNT_DB_DATA_CONTAINER_URL into the .env. Clarified --owner-tag help text re: subscription tag policy.
• infra/env.demo.template — Storage URL line commented out (now auto-injected).
• infra/DEPLOY_NEW_INSTANCE.md — Updated resource table, prerequisites, secret-update warning, new "Blob storage errors" troubleshooting section, --owner-tag marked Conditional with policy explanation.

Tests and Documentation

No unit tests — deploy_instance.py is a CLI wrapper around az commands, validated via --dry-run and mocked end-to-end testing. Manually verified Azure CLI flag compatibility (--public-access "off", Storage Blob Data Contributor role includes generateUserDelegationKey).

Documentation updated in infra/DEPLOY_NEW_INSTANCE.md.

No JupyText changes — no doc notebooks affected.