feat(19-01): add AppRegistrationService with rollback, model, and interface

- AppRegistrationResult discriminated result (Success/Failure/FallbackRequired)
- TenantProfile.AppId nullable string for storing registered app ID
- IAppRegistrationService interface (IsGlobalAdminAsync, RegisterAsync, RemoveAsync, ClearMsalSessionAsync)
- AppRegistrationService: sequential registration with rollback, transitiveMemberOf admin check, MSAL eviction

SharepointToolbox/Core/Models/AppRegistrationResult.cs

@@ -0,0 +1,33 @@
+namespace SharepointToolbox.Core.Models;
+
+/// <summary>
+/// Discriminated result type for app registration operations.
+/// Use the static factory methods to construct instances.
+/// </summary>
+public class AppRegistrationResult
+{
+    public bool IsSuccess { get; }
+    public bool IsFallback { get; }
+    public string? AppId { get; }
+    public string? ErrorMessage { get; }
+
+    private AppRegistrationResult(bool isSuccess, bool isFallback, string? appId, string? errorMessage)
+    {
+        IsSuccess = isSuccess;
+        IsFallback = isFallback;
+        AppId = appId;
+        ErrorMessage = errorMessage;
+    }
+
+    /// <summary>Registration succeeded; carries the newly-created appId.</summary>
+    public static AppRegistrationResult Success(string appId) =>
+        new(isSuccess: true, isFallback: false, appId: appId, errorMessage: null);
+
+    /// <summary>Registration failed; carries an error message.</summary>
+    public static AppRegistrationResult Failure(string errorMessage) =>
+        new(isSuccess: false, isFallback: false, appId: null, errorMessage: errorMessage);
+
+    /// <summary>User lacks the required permissions — caller should show fallback instructions.</summary>
+    public static AppRegistrationResult FallbackRequired() =>
+        new(isSuccess: false, isFallback: true, appId: null, errorMessage: null);
+}

SharepointToolbox/Core/Models/TenantProfile.cs

@@ -6,4 +6,11 @@ public class TenantProfile
     public string TenantUrl { get; set; } = string.Empty;
     public string ClientId { get; set; } = string.Empty;
     public LogoData? ClientLogo { get; set; }
+
+    /// <summary>
+    /// The Azure AD application (client) ID registered for this tenant profile.
+    /// Null when no app registration has been performed yet.
+    /// Cleared to null after successful removal.
+    /// </summary>
+    public string? AppId { get; set; }
 }