[Feature]: App-only (client credentials) auth for the remaining Microsoft pieces

Problem

App-only (client credentials) auth exists only on Microsoft Outlook (PR 13908, merged 2026-07-02, live on cloud since the 2026-07-07 deploy). Every other Microsoft piece is delegated-only, so flows must run as one signed-in user. Blocks enterprise customers of a paid embed account who cannot have a single user authenticated; they offered to open the PR themselves if we don't take it.

Ref: Pylon 4966

Current behavior (verified in code)

Only microsoft-outlook sets grantType: 'both_client_credentials_and_authorization_code' — packages/pieces/community/microsoft-outlook/src/lib/common/auth.ts.

All others hardcode /common/ in authUrl/tokenUrl, use a fixed delegated scope array, and have no tenant/target props — e.g. packages/pieces/community/microsoft-excel-365/src/lib/auth.ts.

/me call sites to convert per piece: todo 22, onenote 16, teams 12, excel 11, 365-people 10, onedrive 9, planner 2, outlook-calendar 1, sharepoint 0.

Scope

Customer priority order: Excel 365, OneDrive, then SharePoint, Teams, Outlook Calendar, To Do, OneNote, 365 People, 365 Planner, Azure DevOps, etc.

Per piece, mirror the Outlook pattern:

• grantType: 'both_client_credentials_and_authorization_code'; {tenant} in authUrl/tokenUrl, default common.
• Access Mode dropdown: delegated scopes vs https://graph.microsoft.com/.default (+ graph.microsoft.us for GCC High).
• Optional target prop (user / drive / site id), required for app-only; its presence switches /me → /users/{id}.
• validate callback on one read endpoint.
• Piece version bump. Existing delegated connections unchanged.

Hoist the duplicated microsoft-cloud.ts (already copy-pasted across outlook/excel/onedrive) plus the new access-mode and tenant props into one shared helper before the third piece, not 9 copies.

Constraints

Not every delegated endpoint has an app-only equivalent (/me/chats, personal To Do lists). Where Graph has no app-only path, keep that piece delegated-only and state it in the auth description instead of shipping an option that 403s.

Shared Azure app cannot grant app-only — customers register their own app and grant admin consent (already covered in the Outlook auth description).