Add Outlook unread-mail widget with device-code login

- outlook-auth.js: one-time device-code flow against Microsoft login;
  stores the refresh token in the outlook-tokens compose volume
- update-outlook.js: per-minute cron fetching the unread count and the
  latest unread messages via Microsoft Graph; caches access tokens and
  persists rotated refresh tokens
- Widget is hidden until the mailbox is actually authorized, so it
  stays out of sight while (admin) consent is pending
- New external card for Outlook (Office 365) with the official icon
- compose: pass OUTLOOK_CLIENT_ID/OUTLOOK_TENANT/GITEA_TOKEN from .env
- README: Entra ID app registration steps and the tenant-ID hint for
  directories not resolvable via the organizations endpoint

docker-compose.yml

@@ -13,9 +13,13 @@ services:
       - TZ=Europe/Vienna
       # Secrets live in .env (gitignored) — compose reads it automatically.
       - OPENWEBUI_TOKEN=${OPENWEBUI_TOKEN:-}
+      - GITEA_TOKEN=${GITEA_TOKEN:-}
+      # Outlook unread-mail widget (see README for the Entra ID app registration
+      # and the one-time device login).
+      - OUTLOOK_CLIENT_ID=${OUTLOOK_CLIENT_ID:-}
+      - OUTLOOK_TENANT=${OUTLOOK_TENANT:-organizations}
       # Optional API tokens for live stats / git integration.
       # Uncomment and fill in to enable private git stats.
-      # - GITEA_TOKEN=
       # - GITLAB_TOKEN=
       # - NETBIRD_TOKEN=
       # GPU stats upstream; defaults to the gpu-stats service below.
@@ -25,6 +29,9 @@ services:
       # - GPU_STATS_URL=http://gpu-stats:9101/stats
       # Ollama instance for the loaded-model stats in the GPU widget.
       # - OLLAMA_URL=http://100.103.83.12:11435
+    volumes:
+      # Persists the Outlook OAuth refresh token across container updates.
+      - outlook-tokens:/opt/dashboard/tokens
     logging:
       driver: json-file
       options:
@@ -53,3 +60,6 @@ services:
       options:
         max-size: "1m"
         max-file: "2"
+
+volumes:
+  outlook-tokens: