fix: Remove Exposed Speech Service API Key from Network Calls

[Prasanjeet-Microsoft]

Purpose

The purpose of this pull request is to enhance the security of the Speech Synthesis integration by eliminating the exposure of the Azure Speech API key in browser network calls.

Previously, the frontend received and used the Speech API subscription key directly to initialize the speech synthesizer, which could be viewed in browser developer tools. While access to the app is restricted via Entra ID, exposing sensitive keys in client-side code is still a security risk.

To resolve this, we have:

• Replaced the use of the long-lived Speech API key with a short-lived authorization token retrieved securely from the backend.
• Updated both backend and frontend code to support token-based initialization of the Azure Speech Synthesizer.

This change ensures sensitive credentials are no longer exposed to end users and follows best practices for secure API consumption.

Backend changes:

• Removed the key field from the speech_config response in code/create_app.py, as the backend no longer provides the subscription key.

Frontend changes:

• Replaced the key field with token in the synthesizerData state in Answer.tsx.
• Updated the initializeSynthesizer function to use SpeechConfig.fromAuthorizationToken instead of SpeechConfig.fromSubscription, reflecting the switch to token-based authentication.
• Adjusted the useEffect logic to check for a non-empty token instead of key before initializing the synthesizer.
• Updated the fetchSynthesizerData function to set the token field in synthesizerData instead of key. Minor formatting improvement was also made to the error logging.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

What to Check

Verify that the following are valid:

• Speech synthesis works correctly with the new token-based setup.
• No API key is visible in browser network calls.
• Token is properly fetched from the backend and used on the frontend.
• No functional regressions introduced in the chat or speech flow.