feat(mail): M365 Graph sync + bot ETL loop (OO+Gmail) (#38)

* feat(mail): add Microsoft 365 Graph sync source with delta state

Adds a GET-only Microsoft Graph source to bin/mail/sync (client-credentials,
delta query). Wires it into the CLI (--source m365), the worker pool and the
compose stack:

- m365.go: M365Client (token cache, delta pagination, message normalization,
  attachment download) + m365Source adapter (per-mailbox folders + delta link)
- sync.go: M365Credentials in SyncConfig; Committer interface so delta links
  only advance after a fully successful run (no skips on failure)
- cli.go: --source m365 with M365_/MS_ env passthrough
- Dockerfile: mail-build stage produces /mail-sync into the index image
- docker-entrypoint: mail-sync loop (sync -> import -> index, default 10s)
- compose.yaml: mail-sync service (index image, kb-var volume, secrets ro)

* feat(mail): adapt M365 ETL loop for OO+Gmail bots.

Default compose mail-sync to onlyoffice,gmail every 300s with import on new
mail; gate full --rebuild behind MAIL_SYNC_INDEX. Fix mail-build stage order
and add bin/stack/start-mail-sync.

compose.yaml

@@ -92,6 +92,38 @@ services:
     tmpfs:
       - /tmp
 
+  # mail-sync ETL: sync → import every 300s into shared var. Full brain rebuild
+  # only when MAIL_SYNC_INDEX=1 (expensive on large mail corpora). Default
+  # sources: onlyoffice,gmail. For M365 set MAIL_SYNC_SRC=m365 and put
+  # M365_TENANT/CLIENT_ID/CLIENT_SECRET/USERS in ~/.config/brain/mail.env
+  # (or m365.env + MAIL_SYNC_ENV). Gmail OAuth: mount ~/.gmail-mcp.
+  #   docker compose up -d mail-sync
+  #   bin/stack/start-mail-sync
+  mail-sync:
+    image: ghcr.io/eslider/2dph:index
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: index
+    environment:
+      HF_HOME: /data/hf
+      KB_PY: python3
+      MAIL_SYNC_SRC: onlyoffice,gmail
+      MAIL_SYNC_ENV: /secret/mail.env
+      MAIL_SYNC_INDEX: "0"
+      HOME: /home/2dph
+    volumes:
+      - kb-model:/data/hf
+      - kb-var:/app/var
+      - ~/.config/brain:/secret:ro
+      - ~/.gmail-mcp:/home/2dph/.gmail-mcp:ro
+    command: ["mail-sync", "300"]
+    read_only: true
+    tmpfs:
+      - /tmp
+    restart: unless-stopped
+    stop_grace_period: 20s
+
   # Optional local SearXNG (D3). Skip if BRAIN_SEARCH_URL already points at a
   # live instance — do not run a second copy on that host.
   #   SEARXNG_SECRET=$(openssl rand -hex 32) docker compose --profile searxng up -d