release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

.gitignore

@@ -1,16 +1,38 @@
+# Editor / OS
 .vs/
 .vscode/
+.DS_Store
+
+# Git
 .git/
+
+# PowerShell / logs
 /*.Log
 /*.Lo_
+IntuneManagement.log
+
+# Local exports, backups and generated reports
 /*.csv
 /*.zip
 /*.new
 /*.old
 /Extensions/*.zip
-.gitignore
-IntuneManagement.log
+Exporting */
+*.backup/
+*.backup
+
+# Graph metadata cache
 GraphMetaData.xml
 %LOCALAPPDATA%/
 *%LOCALAPPDATA%*
 CloudAPIPowerShellManagement/
+
+# Local application settings (contains secrets on non-macOS platforms)
+Settings.json
+
+# Python
+__pycache__/
+*.pyc
+*.pyo
+.venv-pdf/
+.venv/