feat(mail): M365 Graph sync + bot ETL loop (OO+Gmail) (#38)

* feat(mail): add Microsoft 365 Graph sync source with delta state

Adds a GET-only Microsoft Graph source to bin/mail/sync (client-credentials,
delta query). Wires it into the CLI (--source m365), the worker pool and the
compose stack:

- m365.go: M365Client (token cache, delta pagination, message normalization,
  attachment download) + m365Source adapter (per-mailbox folders + delta link)
- sync.go: M365Credentials in SyncConfig; Committer interface so delta links
  only advance after a fully successful run (no skips on failure)
- cli.go: --source m365 with M365_/MS_ env passthrough
- Dockerfile: mail-build stage produces /mail-sync into the index image
- docker-entrypoint: mail-sync loop (sync -> import -> index, default 10s)
- compose.yaml: mail-sync service (index image, kb-var volume, secrets ro)

* feat(mail): adapt M365 ETL loop for OO+Gmail bots.

Default compose mail-sync to onlyoffice,gmail every 300s with import on new
mail; gate full --rebuild behind MAIL_SYNC_INDEX. Fix mail-build stage order
and add bin/stack/start-mail-sync.

bin/tools/test_stack.py

@@ -9,7 +9,7 @@ import unittest
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
-METHODS = ("start", "start-assistant", "stop", "status")
+METHODS = ("start", "start-assistant", "start-mail-sync", "stop", "status")
 
 
 class StackLayoutTest(unittest.TestCase):
@@ -32,8 +32,10 @@ class StackLayoutTest(unittest.TestCase):
         lib = (ROOT / "bin" / "stack" / "lib.sh").read_text()
         self.assertIn("stack_start", lib)
         self.assertIn("stack_start_assistant", lib)
+        self.assertIn("stack_start_mail_sync", lib)
         self.assertIn("stack_stop", lib)
         self.assertIn("stack_status", lib)
+        self.assertIn("mail-sync", lib)
         self.assertIn("qwen3.5:9b", lib)
         self.assertIn("picoclaw agent", lib)
         self.assertIn("--no-deps", lib)
@@ -49,6 +51,16 @@ class StackLayoutTest(unittest.TestCase):
         self.assertNotIn("stack_start_assistant", start)
         self.assertNotIn("picoclaw agent", start)
 
+    def test_start_mail_sync_is_etl_only(self) -> None:
+        src = (ROOT / "bin" / "stack" / "start-mail-sync").read_text()
+        self.assertIn("stack_start_mail_sync", src)
+        self.assertNotIn("stack_start_assistant", src)
+        ep = (ROOT / "bin" / "docker-entrypoint").read_text()
+        self.assertIn('MAIL_SYNC_SRC:=onlyoffice,gmail', ep)
+        self.assertIn('MAIL_SYNC_INDEX:=0', ep)
+        self.assertIn('interval="${1:-300}"', ep)
+        self.assertIn('MAIL_SYNC_INDEX" = "1"', ep)
+
     def test_start_assistant_attaches_agent(self) -> None:
         src = (ROOT / "bin" / "stack" / "start-assistant").read_text()
         self.assertIn("stack_start_assistant", src)
@@ -151,7 +163,10 @@ exit 0
                 check=False,
             )
             self.assertEqual(r.returncode, 0, r.stderr)
-            self.assertFalse(log.exists(), "healthy brain must not docker compose up")
+            if log.exists():
+                logged = log.read_text()
+                self.assertNotIn("up -d", logged, "healthy brain must not docker compose up")
+                self.assertIn("ps", logged)  # status probes mail-sync via compose ps
 
     def test_start_ups_brain_when_unhealthy(self) -> None:
         with tempfile.TemporaryDirectory() as raw:
@@ -190,7 +205,7 @@ exit 0
             logged = log.read_text()
             self.assertIn("stop", logged)
             self.assertNotIn(" down", logged)
-            for svc in ("brain", "brain-mcp", "reasoner", "picoclaw"):
+            for svc in ("brain", "brain-mcp", "reasoner", "picoclaw", "mail-sync"):
                 self.assertIn(svc, logged)
 
     def test_start_assistant_no_attach_starts_picoclaw(self) -> None: