Policies-Tab: Export/Import (Settings Catalog, Compliance, Config)

Neuer Tab "Policies" zum Sichern und Wiederherstellen von Intune-Policies.

- Backend src/PolicyIO.ps1: typ-getrieben fuer configurationPolicies
  (Settings Catalog), deviceCompliancePolicies und deviceConfigurations
- Export als JSON-Download (einzeln/Bundle) + Server-Archiv unter %APPDATA%
- Import per Datei-Upload, immer Neuanlage (nie ueberschreiben), robust fuer
  Hashtable (PS7) und PSCustomObject (PS5.1); im Read-Only-Modus ausgeblendet
- Routen in src/Api.ps1; Config-Scope DeviceManagementConfiguration.* auch
  nach Settings-Save sichergestellt
- Frontend: Tab + View, Suche/Typ-Filter/Sortierung, Auswahl, Download/Upload
- Version 0.1.25 (Start.ps1, CHANGELOG, README)
- build-local.ps1: x64-.NET-Runtime fuer wix auf ARM64-Windows + echter
  Desktop-Pfad

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Api.ps1

@@ -46,6 +46,13 @@ function Invoke-ApiHandler {
         "POST /api/membership/bulk"  { return Get-MembershipBulkEndpoint -Body $Body }
 
         "POST /api/assignments/apply" { return Invoke-ApplyEndpoint -Body $Body }
+
+        "GET /api/policies/compliance"    { return Get-CompliancePoliciesEndpoint }
+        "GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
+        "GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
+        "POST /api/policies/export"       { return Export-PoliciesEndpoint -Body $Body }
+        "GET /api/policies/exports"       { return Get-PolicyExportsEndpoint }
+        "POST /api/policies/import"       { return Import-PoliciesEndpoint -Body $Body }
     }
 
     # 2-segment fallbacks (z.B. /api/groups/<id>/members)
@@ -165,6 +172,15 @@ function Sync-ConfigFromSettings {
     $script:Config.ClientIdRo  = $script:Settings.connection.clientIdRo
     $script:Config.Scopes      = @($script:Settings.connection.scopes)
     $script:Config.ScopesRo    = @($script:Settings.connection.scopesRo)
+    # Policy Export/Import braucht den Configuration-Scope. Immer sicherstellen —
+    # sonst faellt er nach einem Settings-Save (der Config.Scopes neu aus den
+    # persistierten Settings setzt) bis zum Neustart weg.
+    if ($script:Config.Scopes -notcontains 'DeviceManagementConfiguration.ReadWrite.All') {
+        $script:Config.Scopes = @($script:Config.Scopes) + 'DeviceManagementConfiguration.ReadWrite.All'
+    }
+    if ($script:Config.ScopesRo -notcontains 'DeviceManagementConfiguration.Read.All') {
+        $script:Config.ScopesRo = @($script:Config.ScopesRo) + 'DeviceManagementConfiguration.Read.All'
+    }
 }
 
 function Save-SettingsEndpoint {