feat(mail): M365 Graph sync + bot ETL loop (OO+Gmail) (#38)

* feat(mail): add Microsoft 365 Graph sync source with delta state

Adds a GET-only Microsoft Graph source to bin/mail/sync (client-credentials,
delta query). Wires it into the CLI (--source m365), the worker pool and the
compose stack:

- m365.go: M365Client (token cache, delta pagination, message normalization,
  attachment download) + m365Source adapter (per-mailbox folders + delta link)
- sync.go: M365Credentials in SyncConfig; Committer interface so delta links
  only advance after a fully successful run (no skips on failure)
- cli.go: --source m365 with M365_/MS_ env passthrough
- Dockerfile: mail-build stage produces /mail-sync into the index image
- docker-entrypoint: mail-sync loop (sync -> import -> index, default 10s)
- compose.yaml: mail-sync service (index image, kb-var volume, secrets ro)

* feat(mail): adapt M365 ETL loop for OO+Gmail bots.

Default compose mail-sync to onlyoffice,gmail every 300s with import on new
mail; gate full --rebuild behind MAIL_SYNC_INDEX. Fix mail-build stage order
and add bin/stack/start-mail-sync.

Dockerfile

@@ -6,6 +6,15 @@
 # API: Go + ladybug via Zig CGO (no CPython).
 # Index: Python write path (profile `index` until brain/add is v2).
 
+# --- mail-sync: standalone M365/OnlyOffice/Gmail puller (pure Go, no CGO) ---
+FROM golang:1.26-bookworm AS mail-build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY bin/mail ./bin/mail
+COPY internal ./internal
+RUN CGO_ENABLED=0 go build -o /mail-sync ./bin/mail/sync.go
+
 # --- Python sidecar (Ladybug write / rebuild) ---
 FROM python:3.12-slim AS index
 
@@ -28,6 +37,7 @@ RUN python -m pip install --no-cache-dir -r /tmp/requirements.lock.txt \
 COPY . .
 RUN chmod +x /app/bin/docker-entrypoint \
     && chown -R 2dph:2dph /app
+COPY --from=mail-build /mail-sync /app/bin/mail-sync
 USER 2dph
 
 ENV PATH="/app/bin:${PATH}" \