A retail company hosts a web application in Azure App Service across two regions (East US and West Europe). Requirements: route users to the closest healthy backend for lowest latency, automatically fail over if a regional backend becomes unhealthy, terminate TLS at the edge, and protect against common web exploits like SQL injection at Layer 7. Which Azure service should the architect recommend as the global entry point?