Resubmission of closed #21389 (same branch pr/msgraph-auth-client, same author). First slice of the #19815 Teams meeting pipeline stack.

Thanks for splitting this out, and for taking the earlier review direction on #19815 seriously — the plugin + CLI + skill shape is exactly right.

One thing that'll make these much easier to review: the 5 PRs are currently all based on main with cumulative diffs (#21412 contains everything from #21408-#21411). That means we can't see what each slice actually adds on top of the previous one, and merging the bottom of the stack would leave the upper PRs thousands of lines behind.

Could you retarget them as a proper stack so diffs are incremental?

• feat(msgraph): add auth and client foundation #21408 → base main (leave as-is) — MS Graph auth + client foundation
• feat(msgraph): add webhook listener platform #21409 → base pr/msgraph-auth-client — webhook listener only
• feat(teams-pipeline): add plugin runtime and operator cli #21410 → base pr/msgraph-webhook-listener — pipeline runtime + operator CLI
• feat(teams): add pipeline outbound delivery via existing adapter #21411 → base pr/teams-pipeline-plugin-runtime — outbound delivery via existing Teams adapter
• docs(teams): split meetings setup from operator runbook #21412 → base pr/teams-outbound-delivery — docs + skill

gh pr edit <N> --base <branch> does it in place — no close/reopen needed, comments and CI history are preserved. Once #21408 merges, GitHub auto-retargets #21409 to main, and so on up the stack.

Planning to review bottom-up starting with this one. Thanks for working through the split.

gh pr edit is failing with "branch not found" because the intermediate branches don't exist upstream. I don't have write access to push them. Could you advise on how to proceed? @teknium1

Merged via PR #21922. Your two commits (feat(msgraph): add auth and client foundation and test(msgraph): cover concurrent token cache reuse) landed on main with your authorship preserved via rebase-merge — see commits a152c706b and b878f89f6.

Two small follow-ups added on top during salvage:

1. fix(msgraph): stream download_to_file body instead of buffering — the original download_to_file routed through the shared _request() path, which reads the body inside an httpx.AsyncClient context that closes before aiter_bytes() iterates. Tests passed with the 17-byte payload because small bodies are indistinguishable. On real Teams meeting recordings (hundreds of MB) the body would load fully into memory per download. Rewrote to open a dedicated client.stream() and keep the context open across the iteration, preserving retry/token-refresh/Retry-After semantics on the streaming path. Added a discriminating test (512 KiB at chunk_size=65536 → 8 chunks under streaming, 1 under buffering).

2. docs(msgraph): add Azure app registration walkthrough + env var reference — new /docs/guides/microsoft-graph-app-registration covering app registration, client secret, per-capability Graph permissions (transcript-first / recording fallback / Graph-mode delivery), admin consent, New-CsApplicationAccessPolicy for tenant-scoping, token-flow smoke test, AADSTS troubleshooting, and secret rotation. Env var reference gained a Microsoft Graph subsection. Wired into the sidebar.

The remaining PRs in the stack (#21409–#21412) are still open and will be reviewed next against current main. Thanks for splitting the stack up — it made the foundation much easier to land cleanly.