test(02-06): add failing test for PermissionsViewModel multi-site scan

- Write StartScanAsync_WithMultipleSiteUrls_CallsServiceOncePerUrl test (RED)
- Create ISessionManager interface for testability
- Implement ISessionManager on SessionManager
- Add PermissionsViewModel stub (NotImplementedException) to satisfy compile

SharepointToolbox/Services/ISessionManager.cs

@@ -0,0 +1,20 @@
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+/// <summary>
+/// Abstraction over SessionManager, enabling unit testing of ViewModels
+/// without live MSAL/SharePoint connections.
+/// </summary>
+public interface ISessionManager
+{
+    /// <summary>Returns an existing ClientContext or creates one via interactive login.</summary>
+    Task<ClientContext> GetOrCreateContextAsync(TenantProfile profile, CancellationToken ct = default);
+
+    /// <summary>Clears the cached session for the given tenant URL.</summary>
+    Task ClearSessionAsync(string tenantUrl);
+
+    /// <summary>Returns true if an authenticated ClientContext exists for this tenantUrl.</summary>
+    bool IsAuthenticated(string tenantUrl);
+}

SharepointToolbox/Services/SessionManager.cs

@@ -14,7 +14,7 @@ namespace SharepointToolbox.Services;
 /// Every SharePoint operation goes through this class — callers MUST NOT store
 /// ClientContext references; request it fresh each time via GetOrCreateContextAsync.
 /// </summary>
-public class SessionManager
+public class SessionManager : ISessionManager
 {
     private readonly MsalClientFactory _msalFactory;
     private readonly Dictionary<string, ClientContext> _contexts = new();

SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs

@@ -0,0 +1,47 @@
+using System.Collections.ObjectModel;
+using System.Threading;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.Input;
+using Microsoft.Extensions.Logging;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Services;
+
+namespace SharepointToolbox.ViewModels.Tabs;
+
+/// <summary>
+/// STUB: PermissionsViewModel — RED phase. Not yet implemented.
+/// </summary>
+public partial class PermissionsViewModel : FeatureViewModelBase
+{
+    private readonly IPermissionsService _permissionsService;
+    private readonly ISiteListService _siteListService;
+    private readonly ISessionManager _sessionManager;
+
+    public ObservableCollection<SiteInfo> SelectedSites { get; } = new();
+    public ObservableCollection<PermissionEntry> Results { get; private set; } = new();
+
+    internal TenantProfile? _currentProfile;
+
+    public PermissionsViewModel(
+        IPermissionsService permissionsService,
+        ISiteListService siteListService,
+        ISessionManager sessionManager,
+        ILogger<PermissionsViewModel> logger)
+        : base(logger)
+    {
+        _permissionsService = permissionsService;
+        _siteListService = siteListService;
+        _sessionManager = sessionManager;
+    }
+
+    public void SetCurrentProfile(TenantProfile profile) => _currentProfile = profile;
+
+    internal Task TestRunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
+        => RunOperationAsync(ct, progress);
+
+    protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
+    {
+        // RED STUB: always throws to make tests fail at RED phase
+        throw new NotImplementedException("PermissionsViewModel.RunOperationAsync not yet implemented.");
+    }
+}