Add the Entra app-registration request for the SharePoint file picker

The written request for a `WP-Suite-File-Picker` app registration in the
prime-controls.com tenant: SPA platform, delegated Files.Read.All / Sites.Read.All
/ User.Read, admin consent, no secret and no app-only permissions. Keeping it in
the repo means the lowest-privilege configuration we asked IT for is on the record
next to the code that will use it, and whoever wires up the picker can see what
was actually granted rather than reconstructing it from memory.

Dated 2026-06-15, authored by Nick Siegfried. Committed on its own branch off main
because it has nothing to do with the user-directory work that was in flight.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Azure-File-Picker-Request.md

@@ -0,0 +1,60 @@
+# Request: Entra (Azure AD) App Registration — WP Suite SharePoint File Picker
+
+**Requested by:** Nick Siegfried (n.siegfried@prime-controls.com)
+**Date:** 2026-06-15
+**Purpose:** Let users of the Work Package (WP) Suite pick files directly from the
+project's SharePoint folders (Drawings / Specs / Data Sheets) and attach them to a
+work package, instead of manually copying and pasting SharePoint links.
+
+To do this the tool needs to call Microsoft's **OneDrive/SharePoint File Picker
+(File Picker v8)** and **Microsoft Graph** on behalf of the signed-in Prime user.
+That requires an Entra app registration. None of this grants the app standalone
+access — every action runs **as the signed-in user**, so it can only see what that
+user already has permission to in SharePoint.
+
+---
+
+## What we need created
+
+A single **App registration** in the `prime-controls.com` (primecontrolsdallas) tenant.
+
+| Setting | Value |
+|---|---|
+| **Name** | `WP-Suite-File-Picker` |
+| **Supported account types** | Single tenant — *Accounts in this organizational directory only* |
+| **Platform** | **Single-page application (SPA)** |
+| **Redirect URI(s)** | The URL(s) the tool is hosted at — e.g. `https://<wp-suite-host>/wp-creation-index.html` (and `http://localhost:<port>/...` for testing). *Nick to confirm final host.* |
+
+### API permissions (Microsoft Graph — **Delegated**, not Application)
+| Permission | Why |
+|---|---|
+| `Files.Read.All` | Read files the user selects in the picker |
+| `Sites.Read.All` | Resolve the SharePoint site/folder the picker browses |
+| `User.Read` | Basic sign-in (usually present by default) |
+
+> Delegated = acts as the signed-in user. We are **not** requesting application
+> (app-only) permissions, so the app cannot read anything on its own.
+
+### Admin consent
+- Please **grant admin consent** for the delegated permissions above so pilot users
+  aren't each prompted to consent individually.
+
+---
+
+## What we DON'T need
+- No client secret / certificate (SPA uses PKCE, no secret).
+- No application (app-only) permissions.
+- No write/modify permissions — read-only is sufficient for attaching files.
+
+## What to send back to Nick
+1. **Application (client) ID**
+2. **Directory (tenant) ID**
+3. Confirmation that the **redirect URI** was registered and **admin consent** granted.
+
+---
+
+### Background / scope
+This is for an internal pilot of the WP Suite (Project SDE). Today users paste
+SharePoint "Copy Link" URLs by hand. The app registration enables a proper
+"Add files" picker scoped to the SOP's folders. Read-only, single-tenant,
+delegated — lowest-privilege configuration that makes the picker work.