feat(02-02): define PermissionEntry, ScanOptions, and IPermissionsService

- PermissionEntry record with 9 fields matching PS Generate-PnPSitePermissionRpt
- ScanOptions record with defaults: IncludeInherited=false, ScanFolders=true, FolderDepth=1, IncludeSubsites=false
- IPermissionsService interface with ScanSiteAsync method enabling ViewModel mocking

SharepointToolbox/Services/IPermissionsService.cs

@@ -0,0 +1,17 @@
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+/// <summary>
+/// Contract for the permission scan engine.
+/// Enables ViewModel mocking in unit tests.
+/// </summary>
+public interface IPermissionsService
+{
+    Task<IReadOnlyList<PermissionEntry>> ScanSiteAsync(
+        ClientContext ctx,
+        ScanOptions options,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct);
+}