test(02-06): add failing test for PermissionsViewModel multi-site scan

- Write StartScanAsync_WithMultipleSiteUrls_CallsServiceOncePerUrl test (RED)
- Create ISessionManager interface for testability
- Implement ISessionManager on SessionManager
- Add PermissionsViewModel stub (NotImplementedException) to satisfy compile

SharepointToolbox/Services/ISessionManager.cs

@@ -0,0 +1,20 @@
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+/// <summary>
+/// Abstraction over SessionManager, enabling unit testing of ViewModels
+/// without live MSAL/SharePoint connections.
+/// </summary>
+public interface ISessionManager
+{
+    /// <summary>Returns an existing ClientContext or creates one via interactive login.</summary>
+    Task<ClientContext> GetOrCreateContextAsync(TenantProfile profile, CancellationToken ct = default);
+
+    /// <summary>Clears the cached session for the given tenant URL.</summary>
+    Task ClearSessionAsync(string tenantUrl);
+
+    /// <summary>Returns true if an authenticated ClientContext exists for this tenantUrl.</summary>
+    bool IsAuthenticated(string tenantUrl);
+}

SharepointToolbox/Services/SessionManager.cs

@@ -14,7 +14,7 @@ namespace SharepointToolbox.Services;
 /// Every SharePoint operation goes through this class — callers MUST NOT store
 /// ClientContext references; request it fresh each time via GetOrCreateContextAsync.
 /// </summary>
-public class SessionManager
+public class SessionManager : ISessionManager
 {
     private readonly MsalClientFactory _msalFactory;
     private readonly Dictionary<string, ClientContext> _contexts = new();