fix(07): fix people picker selection and audit service authentication

People picker ListBox used MouseBinding which fires before SelectedItem
updates, causing null CommandParameter. Replaced with SelectionChanged
event handler in code-behind.

AuditUsersAsync created TenantProfile with empty ClientId, causing
ArgumentException in SessionManager. Added currentProfile parameter
to pass the authenticated tenant's ClientId through.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

SharepointToolbox.Tests/ViewModels/UserAccessAuditViewModelTests.cs

@@ -49,6 +49,7 @@ public class UserAccessAuditViewModelTests
         mockAudit
             .Setup(s => s.AuditUsersAsync(
                 It.IsAny<ISessionManager>(),
+                It.IsAny<TenantProfile>(),
                 It.IsAny<IReadOnlyList<string>>(),
                 It.IsAny<IReadOnlyList<SiteInfo>>(),
                 It.IsAny<ScanOptions>(),
@@ -65,6 +66,14 @@ public class UserAccessAuditViewModelTests
             mockSession.Object,
             NullLogger<FeatureViewModelBase>.Instance);
 
+        // Set a default profile so RunOperationAsync doesn't early-return
+        vm._currentProfile = new TenantProfile
+        {
+            Name = "Test",
+            TenantUrl = "https://contoso.sharepoint.com",
+            ClientId = "test-client-id"
+        };
+
         return (vm, mockAudit, mockGraph);
     }
 
@@ -83,6 +92,7 @@ public class UserAccessAuditViewModelTests
         auditMock.Verify(
             s => s.AuditUsersAsync(
                 It.IsAny<ISessionManager>(),
+                It.IsAny<TenantProfile>(),
                 It.IsAny<IReadOnlyList<string>>(),
                 It.IsAny<IReadOnlyList<SiteInfo>>(),
                 It.IsAny<ScanOptions>(),