Add Outlook unread-mail widget with device-code login

- outlook-auth.js: one-time device-code flow against Microsoft login;
  stores the refresh token in the outlook-tokens compose volume
- update-outlook.js: per-minute cron fetching the unread count and the
  latest unread messages via Microsoft Graph; caches access tokens and
  persists rotated refresh tokens
- Widget is hidden until the mailbox is actually authorized, so it
  stays out of sight while (admin) consent is pending
- New external card for Outlook (Office 365) with the official icon
- compose: pass OUTLOOK_CLIENT_ID/OUTLOOK_TENANT/GITEA_TOKEN from .env
- README: Entra ID app registration steps and the tenant-ID hint for
  directories not resolvable via the organizations endpoint

Dockerfile

@@ -12,8 +12,8 @@ COPY nginx.conf /etc/nginx/conf.d/default.conf
 # Backend scripts (node_modules included so the build works offline).
 COPY api /opt/dashboard
 
-# Cron refreshes the data feed every 15 minutes and health checks every minute.
-RUN printf '*/15 * * * * cd /opt/dashboard && node update-data.js\n* * * * * cd /opt/dashboard && node update-health.js\n' > /etc/crontabs/root
+# Cron: data feed every 15 min, health checks + Outlook unread every minute.
+RUN printf '*/15 * * * * cd /opt/dashboard && node update-data.js\n* * * * * cd /opt/dashboard && node update-health.js\n* * * * * cd /opt/dashboard && node update-outlook.js\n' > /etc/crontabs/root
 
 # Entrypoint: run updater once, start API proxy + cron, then nginx.
 COPY docker-entrypoint.sh /docker-entrypoint.sh