A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream).
OptionalAppThe bot's Azure AD application (client) id (carried for diagnostics).
OptionalTenantThe Azure tenant id the bot operates in (carried for diagnostics + cross-tenant joins).
Credentials RealGraphCallsClient authenticates Graph with. Resolved upstream via MJ config — never inlined.