feat(toolkit): complete macOS Intune Toolkit v1

Core enhancements:
- Expanded default export/import scope to ~45 object types including DeviceManagementIntents
- Added -AllPages pagination support across Graph queries for large tenants
- Invoke-GraphRequest now throws on 4xx/5xx instead of silently returning null
- Added macOS Keychain fallback for secret retrieval in headless auth flow
- Added NameSearchPattern/NameReplacePattern mutation support through export/import forms

New toolkit scripts:
- Bulk-AppAssignment.ps1: bulk-assign apps to groups/All Users/All Devices
- Bulk-AssignmentManager.ps1: add/remove assignments for any policy type with correct @odata.type
- Backup-Restore-Assignments.ps1: JSON backup with cross-tenant group resolution
- Export-AssignmentsToCsv.ps1: CSV/Markdown documentation output
- Bulk-RenamePolicies.ps1: regex search/replace and prefix mutations
- Bulk-DeviceOperations.ps1: delete/retire/wipe/lock/sync with -WhatIf safeguards
- Start-IntuneManagementTui.ps1: interactive terminal UI for headless operations
- Create-IntuneManagementApp.ps1: helper for app registration setup

Updated existing scripts:
- Export-Policies.ps1 / Import-Policies.ps1: wired mutation params through
- Start-HeadlessIntune.ps1: integrated TUI and new parameter forwarding

Start-HeadlessIntune.ps1

@@ -1,6 +1,5 @@
 [CmdletBinding()]
 param(
-    [Parameter(Mandatory = $true)]
     [ValidateSet("Export","Import")]
     [string]$Action,
 
@@ -13,7 +12,7 @@ param(
 
     [string]$Certificate,
 
-    [ValidateSet("AppOnly","Browser")]
+    [ValidateSet("AppOnly","Browser","DeviceCode")]
     [string]$AuthMode = "AppOnly",
 
     [string]$RedirectUri,
@@ -24,6 +23,10 @@ param(
 
     [string]$NameFilter = "",
 
+    [string]$NameSearchPattern = "",
+
+    [string]$NameReplacePattern = "",
+
     [string[]]$ObjectTypes,
 
     [string]$ExportPath,
@@ -39,12 +42,48 @@ param(
 
     [switch]$IncludeScopeTags,
 
-    [switch]$ReplaceDependencyIds
+    [switch]$ReplaceDependencyIds,
+
+    [switch]$Interactive
 )
 
 $modulePath = Join-Path $PSScriptRoot "Headless/IntuneManagement.Headless.psd1"
 Import-Module $modulePath -Force
 
+if($Interactive -and -not $Action)
+{
+    Write-Host "Interactive mode will prompt for the action and other settings." -ForegroundColor Cyan
+}
+elseif(-not $Action)
+{
+    throw "Action is required. Use -Interactive to select it in a terminal UI."
+}
+
+if($Interactive)
+{
+    $tuiScript = Join-Path $PSScriptRoot "Scripts/Start-IntuneManagementTui.ps1"
+    if(Test-Path $tuiScript)
+    {
+        $tuiResult = & $tuiScript
+        if(-not $tuiResult) { Write-Host "No selection made. Exiting." -ForegroundColor Yellow; exit 0 }
+        foreach($prop in $tuiResult.PSObject.Properties)
+        {
+            if($prop.Value -ne $null -and $prop.Name -ne "Action")
+            {
+                Set-Variable -Name $prop.Name -Value $prop.Value
+            }
+            elseif($prop.Name -eq "Action")
+            {
+                $Action = $prop.Value
+            }
+        }
+    }
+    else
+    {
+        throw "TUI script not found: $tuiScript"
+    }
+}
+
 $invokeParams = @{
     Action = $Action
     TenantId = $TenantId
@@ -53,6 +92,8 @@ $invokeParams = @{
     SettingsFile = $SettingsFile
     BatchFile = $BatchFile
     NameFilter = $NameFilter
+    NameSearchPattern = $NameSearchPattern
+    NameReplacePattern = $NameReplacePattern
     ExportPath = $ExportPath
     ImportPath = $ImportPath
     ImportType = $ImportType
@@ -62,7 +103,9 @@ $invokeParams = @{
     ReplaceDependencyIds = $ReplaceDependencyIds
 }
 
-if($PSBoundParameters.ContainsKey("ObjectTypes"))
+if($Interactive -and $Action) { $invokeParams.Action = $Action }
+
+if($PSBoundParameters.ContainsKey("ObjectTypes") -or $ObjectTypes)
 {
     $invokeParams.ObjectTypes = $ObjectTypes
 }