test(02-06): add failing test for PermissionsViewModel multi-site scan

- Write StartScanAsync_WithMultipleSiteUrls_CallsServiceOncePerUrl test (RED)
- Create ISessionManager interface for testability
- Implement ISessionManager on SessionManager
- Add PermissionsViewModel stub (NotImplementedException) to satisfy compile

SharepointToolbox/Services/SessionManager.cs

@@ -14,7 +14,7 @@ namespace SharepointToolbox.Services;
 /// Every SharePoint operation goes through this class — callers MUST NOT store
 /// ClientContext references; request it fresh each time via GetOrCreateContextAsync.
 /// </summary>
-public class SessionManager
+public class SessionManager : ISessionManager
 {
     private readonly MsalClientFactory _msalFactory;
     private readonly Dictionary<string, ClientContext> _contexts = new();