Use --list-permissions to compute minimal ms-365-mcp scopes

To find what scopes a tool subset needs, run npx -y @softeria/ms-365-mcp-server --org-mode --enabled-tools '<regex>' --list-permissions. It outputs JSON with permissions, effectivePermissions, disabledTools and missingAllowedScopesForTools. Use it to extend --allowed-scopes narrowly, because bare --org-mode requests a huge bundle including admin-only scopes that fails on tenants blocking user consent. Group.Read.All needs admin approval, so a tenant admin must consent on the login screen after re-login, and Claude Code must be restarted to pick up the changed config.