dotfill 1.5.1

The optional Entra identity probe now uses Microsoft's MSAL Windows broker
inside dotfill. This removes the encoded PowerShell helper while keeping
sign-in silent and tokens out of logs, API responses, and browser state.

• Built-in client requests use the Microsoft Graph .default scope; configured
  clients continue to request User.Read.
• Timed-out lookups remain limited to one active worker, including after
  configuration changes. Expired work skips further token and Graph requests;
  retries resume after the original worker exits.
• Broker failures have short diagnostics, including guidance when an app
  registration is missing its broker redirect URI.

Validation: 442 tests passed; wheel and source distribution checks, a publishing
dry run, and an isolated wheel installation smoke test passed.

Full changelog: v1.5.0...v1.5.1