feat(mail): M365 Graph sync + bot ETL loop (OO+Gmail) (#38)

* feat(mail): add Microsoft 365 Graph sync source with delta state

Adds a GET-only Microsoft Graph source to bin/mail/sync (client-credentials,
delta query). Wires it into the CLI (--source m365), the worker pool and the
compose stack:

- m365.go: M365Client (token cache, delta pagination, message normalization,
  attachment download) + m365Source adapter (per-mailbox folders + delta link)
- sync.go: M365Credentials in SyncConfig; Committer interface so delta links
  only advance after a fully successful run (no skips on failure)
- cli.go: --source m365 with M365_/MS_ env passthrough
- Dockerfile: mail-build stage produces /mail-sync into the index image
- docker-entrypoint: mail-sync loop (sync -> import -> index, default 10s)
- compose.yaml: mail-sync service (index image, kb-var volume, secrets ro)

* feat(mail): adapt M365 ETL loop for OO+Gmail bots.

Default compose mail-sync to onlyoffice,gmail every 300s with import on new
mail; gate full --rebuild behind MAIL_SYNC_INDEX. Fix mail-build stage order
and add bin/stack/start-mail-sync.

bin/stack/lib.sh

@@ -143,12 +143,17 @@ ensure_picoclaw() {
 	wait_health "$PICOCLAW_URL/health" || stack_die "picoclaw health failed at $PICOCLAW_URL/health"
 }
 
+mail_sync_running() {
+	compose ps --status running --services 2>/dev/null | grep -qx mail-sync
+}
+
 stack_status() {
-	local bh=down mcp=down ph=down present=false
+	local bh=down mcp=down ph=down present=false ms=down
 	health_ok "$BRAIN_URL/health" && bh=ok
 	mcp_ok && mcp=ok
 	reasoner_has_model && present=true
 	health_ok "$PICOCLAW_URL/health" && ph=ok
+	mail_sync_running && ms=ok
 	cat <<EOF
 brain:
   url: $BRAIN_URL
@@ -161,6 +166,9 @@ reasoner:
 picoclaw:
   url: $PICOCLAW_URL
   health: $ph
+mail_sync:
+  service: mail-sync
+  running: $ms
 EOF
 }
 
@@ -168,6 +176,11 @@ stack_start() {
 	ensure_brain
 }
 
+stack_start_mail_sync() {
+	echo "mail-sync: compose up (ETL sync→import; index only if MAIL_SYNC_INDEX=1)" >&2
+	compose up -d mail-sync
+}
+
 stack_attach_agent() {
 	local opts=()
 	if [[ -t 0 && -t 1 ]]; then
@@ -230,6 +243,6 @@ stack_stop() {
 		return 0
 		;;
 	esac
-	echo "stack: stop brain brain-mcp reasoner picoclaw (volumes kept)" >&2
-	compose --profile picoclaw --profile reasoner stop picoclaw brain-mcp reasoner brain
+	echo "stack: stop brain brain-mcp reasoner picoclaw mail-sync (volumes kept)" >&2
+	compose --profile picoclaw --profile reasoner stop picoclaw brain-mcp reasoner brain mail-sync
 }

bin/stack/start-mail-sync

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# bin/stack/start-mail-sync - compose up mail-sync ETL (sync → import; optional index).
+#
+#   bin/stack/start-mail-sync
+#
+# Default: onlyoffice,gmail every 300s into kb-var. Full --rebuild only if
+# MAIL_SYNC_INDEX=1 in compose/env. Secrets: ~/.config/brain/mail.env +
+# ~/.gmail-mcp (mounted). Does not start brain/picoclaw.
+set -euo pipefail
+
+STACK_DIR="$(CDPATH= cd -- "$(dirname "$0")" && pwd)"
+# shellcheck source=lib.sh
+source "$STACK_DIR/lib.sh"
+case "${1:-}" in
+-h | --help)
+	stack_usage "$0"
+	exit 0
+	;;
+esac
+stack_start_mail_sync "$@"
+stack_status

bin/stack/stop

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# bin/stack/stop - stop compose brain / brain-mcp / reasoner / picoclaw.
+# bin/stack/stop - stop compose brain / brain-mcp / reasoner / picoclaw / mail-sync.
 #
 #   bin/stack/stop
 #