System of record and search live in the same Cosmos DB container — no sync pipeline, no separate search cluster to operate. Auth is Azure AD end-to-end (DefaultAzureCredential); no keys in code. See ...