Azure/terraform-azure-avm-ptn-alz-sub-vending ? reverse-engineered prompt

Build me a Terraform module for Azure that can spin up a new landing zone subscription in one apply. It should be able to create the subscription, place it into the right management group, and set up the usual foundation pieces like resource providers, resource groups, role assignments, and a user assigned managed identity with federated login support for things like GitHub Actions or Terraform Cloud.

I also want the networking setup to be handled here, so I can create one or more virtual networks, choose the location for each one, and optionally connect them to a hub network or peer them together. If possible, support using IPAM pools for dynamic address space instead of hardcoding CIDRs.

Please make it feel like a reusable module I can call many times for different subscriptions, and include a clear example so I can see how to wire the inputs together. If you need to check current Azure or Terraform docs, go ahead and look them up online.