test(02-01): scaffold PermissionsService, ViewModel, and classification test stubs

- PermissionEntryHelper.cs: pure static IsExternalUser, FilterPermissionLevels, IsSharingLinksGroup
- PermissionEntryClassificationTests.cs: 7 real [Fact] tests — all passing immediately
- PermissionsServiceTests.cs: 2 stubs (PERM-01, PERM-04) skipped until Plan 02 CSOM impl
- PermissionsViewModelTests.cs: 1 stub (PERM-02) skipped until Plan 02 ViewModel impl

SharepointToolbox/Core/Helpers/PermissionEntryHelper.cs

@@ -0,0 +1,30 @@
+namespace SharepointToolbox.Core.Helpers;
+
+/// <summary>
+/// Pure static helpers for classifying SharePoint permission entries.
+/// </summary>
+public static class PermissionEntryHelper
+{
+    /// <summary>
+    /// Returns true when the login name is a B2B guest (contains #EXT#).
+    /// </summary>
+    public static bool IsExternalUser(string loginName) =>
+        loginName.Contains("#EXT#", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Removes "Limited Access" from the supplied permission levels.
+    /// Returns the remaining levels; returns an empty list when all are removed.
+    /// </summary>
+    public static IReadOnlyList<string> FilterPermissionLevels(IEnumerable<string> levels) =>
+        levels
+            .Where(l => !string.Equals(l, "Limited Access", StringComparison.OrdinalIgnoreCase))
+            .ToList();
+
+    /// <summary>
+    /// Returns true when the login name represents an internal sharing-link group
+    /// or the "Limited Access System Group" pseudo-principal.
+    /// </summary>
+    public static bool IsSharingLinksGroup(string loginName) =>
+        loginName.StartsWith("SharingLinks.", StringComparison.OrdinalIgnoreCase)
+        || loginName.Equals("Limited Access System Group", StringComparison.OrdinalIgnoreCase);
+}