release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

Baselines/banned-passwords.txt

@@ -0,0 +1,26 @@
+# CIS M365 v7 — Banned Passwords (external list)
+# One password per line; lines starting with # are ignored
+# These are merged with any inline bannedPasswords in the YAML baseline
+
+# Common corporate names
+Contoso
+Fabrikam
+Northwind
+Wingtip
+
+# Common weak passwords
+Password
+Welcome
+Admin
+Login
+Passw0rd
+Qwerty
+123456
+
+# Microsoft / Office branding
+Microsoft
+Office365
+Outlook
+Azure
+Teams
+SharePoint