Update 13 NuGet packages, including major bumps: Microsoft.Graph
5.74.0 -> 6.2.0, Microsoft.Kiota.* 1.22.2 -> 2.0.0, and
Serilog.AspNetCore 9.0.0 -> 10.0.0. The set is internally consistent
(Graph 6.2.0 -> Graph.Core 4.0.1 -> Kiota 2.0.0) and builds clean with
no code changes. Add a Dependencies table to the README listing each
package, its pinned version, and purpose.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The register flow exchanged the auth code as a confidential client
(Oidc:ClientId + Oidc:ClientSecret), requiring a pre-provisioned
backing app with a secret. Drop client_secret from the exchange so it
uses PKCE only — the backing app is now a public client and no secret
touches the client-tenant register/connect flows.
The toolbox's own OIDC sign-in still uses Oidc:ClientSecret (unchanged).
Also enable user-secrets (UserSecretsId) so Oidc config stays out of
the committed appsettings.json.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kawa