Provision an Azure Data Explorer (Kusto) cluster + database with system MI, public network access disabled, restrictive outbound, empty `trustedExternalTenants`, and disk encryption. Data-plane access is via Database Admin / User / Viewer roles set inside the database (not Azure RBAC).
