release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

Extensions/EndpointManager.psm1

@@ -102,7 +102,10 @@ function Invoke-InitializeModule
     if(($global:OldAzureApps -is [Array] -and $currentAppID -in $global:OldAzureApps) -or (-not $currentAppID -and -not $customAppID))
     {
         $global:informOldAzureApp = $true
-        Write-Log "Microsoft Intune PowerShell is being decomissioned. Please change to a supported app eg Microsoft Graph or a custom app!" 2            
+        if($global:hideUI -ne $true)
+        {
+            Write-Log "Microsoft Intune PowerShell is being decomissioned. Please change to a supported app eg Microsoft Graph or a custom app!" 2
+        }
     }
 
     $viewPanel = $null
@@ -3616,6 +3619,40 @@ function Start-PostExportSettingsCatalog
     param($obj, $objectType, $path)
 
     Add-EMAssignmentsToExportFile $obj $objectType $path
+
+    # Export the Settings Catalog setting definitions once per backup so the
+    # settings report can resolve settingDefinitionId values to the display
+    # names shown in the Intune portal.
+    Start-ExportSettingsCatalogDefinitions -Path $path
+}
+
+function Start-ExportSettingsCatalogDefinitions
+{
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    $rootPath = Split-Path -Parent $Path
+    if([string]::IsNullOrWhiteSpace($rootPath)) { return }
+
+    $defFile = Join-Path $rootPath "configurationSettings.json"
+    if(Test-Path $defFile) { return }
+
+    try
+    {
+        Write-Log "Exporting Settings Catalog definitions for report resolution -> $defFile"
+        $definitions = Invoke-GraphRequest -Url "/deviceManagement/configurationSettings" -AllPages -ODataMetadata "none"
+        if($definitions -and $definitions.value)
+        {
+            $definitions | ConvertTo-Json -Depth 20 | Out-File -FilePath $defFile -Encoding utf8 -Force
+            Write-Log "Exported $($definitions.value.Count) Settings Catalog definitions"
+        }
+    }
+    catch
+    {
+        Write-Log "Failed to export Settings Catalog definitions: $($_.Exception.Message)" 2
+    }
 }
 
 function Start-PreUpdateSettingsCatalog

Extensions/MSGraph.psm1

@@ -551,15 +551,21 @@ function Invoke-GraphRequest
         }
         catch
         {
-            $retryCount++
             if($NoError -eq $true) { return }
-            if($_.Exception.Response.StatusCode -eq 429 -and $retryCount -le $retryMax)
+            if($_.Exception.Response.StatusCode -eq 429 -and $retryCount -lt $retryMax)
             {
-                # NOT OK - Should use the date property but could not replicate the issue
                 $retryCount++
                 $retryRequest = $true
-                Write-Log "429 - Too many requests received. Wait 5 s before retry" 2
-                Start-Sleep -Seconds 5
+                $retryAfterSec = 5
+                try
+                {
+                    $raHeader = $_.Exception.Response.Headers['Retry-After']
+                    if($raHeader) { $retryAfterSec = [int]$raHeader }
+                }
+                catch { }
+                $sleepSec = [Math]::Min($retryAfterSec * [Math]::Pow(2, $retryCount - 1), 120)
+                Write-Log "429 - Too many requests. Retry $retryCount/$retryMax after $sleepSec s" 2
+                Start-Sleep -Seconds $sleepSec
             }
             else
             {