feat(mail): add Microsoft 365 Graph sync source with delta state

Adds a GET-only Microsoft Graph source to bin/mail/sync (client-credentials,
delta query). Wires it into the CLI (--source m365), the worker pool and the
compose stack:

- m365.go: M365Client (token cache, delta pagination, message normalization,
  attachment download) + m365Source adapter (per-mailbox folders + delta link)
- sync.go: M365Credentials in SyncConfig; Committer interface so delta links
  only advance after a fully successful run (no skips on failure)
- cli.go: --source m365 with M365_/MS_ env passthrough
- Dockerfile: mail-build stage produces /mail-sync into the index image
- docker-entrypoint: mail-sync loop (sync -> import -> index, default 10s)
- compose.yaml: mail-sync service (index image, kb-var volume, secrets ro)

.gitignore

@@ -14,3 +14,9 @@ go.work.local
 models/
 # Purged from git history. Do not re-add.
 docs/crm-associations-proof.md
+
+# mount scaffold for the 8TB volume, never part of the repo
+mnt/
+
+# go build ./bin/mail/sync.go drops a binary named `sync` in cwd
+/sync