release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

Extensions/EndpointManager.psm1

@@ -102,7 +102,10 @@ function Invoke-InitializeModule
     if(($global:OldAzureApps -is [Array] -and $currentAppID -in $global:OldAzureApps) -or (-not $currentAppID -and -not $customAppID))
     {
         $global:informOldAzureApp = $true
-        Write-Log "Microsoft Intune PowerShell is being decomissioned. Please change to a supported app eg Microsoft Graph or a custom app!" 2            
+        if($global:hideUI -ne $true)
+        {
+            Write-Log "Microsoft Intune PowerShell is being decomissioned. Please change to a supported app eg Microsoft Graph or a custom app!" 2
+        }
     }
 
     $viewPanel = $null
@@ -3616,6 +3619,40 @@ function Start-PostExportSettingsCatalog
     param($obj, $objectType, $path)
 
     Add-EMAssignmentsToExportFile $obj $objectType $path
+
+    # Export the Settings Catalog setting definitions once per backup so the
+    # settings report can resolve settingDefinitionId values to the display
+    # names shown in the Intune portal.
+    Start-ExportSettingsCatalogDefinitions -Path $path
+}
+
+function Start-ExportSettingsCatalogDefinitions
+{
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path
+    )
+
+    $rootPath = Split-Path -Parent $Path
+    if([string]::IsNullOrWhiteSpace($rootPath)) { return }
+
+    $defFile = Join-Path $rootPath "configurationSettings.json"
+    if(Test-Path $defFile) { return }
+
+    try
+    {
+        Write-Log "Exporting Settings Catalog definitions for report resolution -> $defFile"
+        $definitions = Invoke-GraphRequest -Url "/deviceManagement/configurationSettings" -AllPages -ODataMetadata "none"
+        if($definitions -and $definitions.value)
+        {
+            $definitions | ConvertTo-Json -Depth 20 | Out-File -FilePath $defFile -Encoding utf8 -Force
+            Write-Log "Exported $($definitions.value.Count) Settings Catalog definitions"
+        }
+    }
+    catch
+    {
+        Write-Log "Failed to export Settings Catalog definitions: $($_.Exception.Message)" 2
+    }
 }
 
 function Start-PreUpdateSettingsCatalog