test(02-06): add failing test for PermissionsViewModel multi-site scan

- Write StartScanAsync_WithMultipleSiteUrls_CallsServiceOncePerUrl test (RED)
- Create ISessionManager interface for testability
- Implement ISessionManager on SessionManager
- Add PermissionsViewModel stub (NotImplementedException) to satisfy compile

SharepointToolbox.Tests/ViewModels/PermissionsViewModelTests.cs

@@ -1,22 +1,67 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.SharePoint.Client;
+using Moq;
 using SharepointToolbox.Core.Models;
 using SharepointToolbox.Services;
+using SharepointToolbox.ViewModels.Tabs;
 
 namespace SharepointToolbox.Tests.ViewModels;
 
 /// <summary>
-/// Test stubs for PERM-02 (multi-site scan loop).
-/// Skipped until PermissionsViewModel is implemented in Plan 02.
+/// Unit tests for PermissionsViewModel.
+/// PERM-02: multi-site scan loop invokes ScanSiteAsync once per URL.
 /// </summary>
 public class PermissionsViewModelTests
 {
-    [Fact(Skip = "Requires live CSOM context — covered by Plan 02 implementation")]
+    [Fact]
     public async Task StartScanAsync_WithMultipleSiteUrls_CallsServiceOncePerUrl()
     {
-        // PERM-02: When the user supplies N site URLs, IPermissionsService.ScanSiteAsync
-        // is invoked exactly once per URL (sequential, not parallel).
-        // Arrange — requires PermissionsViewModel and a mock IPermissionsService
+        // Arrange
+        var mockPermissionsService = new Mock<IPermissionsService>();
+        mockPermissionsService
+            .Setup(s => s.ScanSiteAsync(
+                It.IsAny<ClientContext>(),
+                It.IsAny<ScanOptions>(),
+                It.IsAny<IProgress<OperationProgress>>(),
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new List<PermissionEntry>());
+
+        var mockSiteListService = new Mock<ISiteListService>();
+
+        var mockSessionManager = new Mock<ISessionManager>();
+        mockSessionManager
+            .Setup(s => s.GetOrCreateContextAsync(It.IsAny<TenantProfile>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync((ClientContext)null!);
+
+        var vm = new PermissionsViewModel(
+            mockPermissionsService.Object,
+            mockSiteListService.Object,
+            mockSessionManager.Object,
+            new NullLogger<PermissionsViewModel>());
+
+        // Set up two site URLs via SelectedSites
+        vm.SelectedSites.Add(new SiteInfo("https://tenant1.sharepoint.com/sites/alpha", "Alpha"));
+        vm.SelectedSites.Add(new SiteInfo("https://tenant1.sharepoint.com/sites/beta", "Beta"));
+        vm.SetCurrentProfile(new TenantProfile
+        {
+            Name = "Test",
+            TenantUrl = "https://tenant1.sharepoint.com",
+            ClientId = "client-id"
+        });
+
         // Act
-        // Assert
-        await Task.CompletedTask;
+        await vm.TestRunOperationAsync(CancellationToken.None, new Progress<OperationProgress>());
+
+        // Assert: ScanSiteAsync called exactly twice (once per URL)
+        mockPermissionsService.Verify(
+            s => s.ScanSiteAsync(
+                It.IsAny<ClientContext>(),
+                It.IsAny<ScanOptions>(),
+                It.IsAny<IProgress<OperationProgress>>(),
+                It.IsAny<CancellationToken>()),
+            Times.Exactly(2));
     }
 }