release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

Extensions/MSGraph.psm1

@@ -551,15 +551,21 @@ function Invoke-GraphRequest
         }
         catch
         {
-            $retryCount++
             if($NoError -eq $true) { return }
-            if($_.Exception.Response.StatusCode -eq 429 -and $retryCount -le $retryMax)
+            if($_.Exception.Response.StatusCode -eq 429 -and $retryCount -lt $retryMax)
             {
-                # NOT OK - Should use the date property but could not replicate the issue
                 $retryCount++
                 $retryRequest = $true
-                Write-Log "429 - Too many requests received. Wait 5 s before retry" 2
-                Start-Sleep -Seconds 5
+                $retryAfterSec = 5
+                try
+                {
+                    $raHeader = $_.Exception.Response.Headers['Retry-After']
+                    if($raHeader) { $retryAfterSec = [int]$raHeader }
+                }
+                catch { }
+                $sleepSec = [Math]::Min($retryAfterSec * [Math]::Pow(2, $retryCount - 1), 120)
+                Write-Log "429 - Too many requests. Retry $retryCount/$retryMax after $sleepSec s" 2
+                Start-Sleep -Seconds $sleepSec
             }
             else
             {