Add Outlook unread-mail widget with device-code login

- outlook-auth.js: one-time device-code flow against Microsoft login;
  stores the refresh token in the outlook-tokens compose volume
- update-outlook.js: per-minute cron fetching the unread count and the
  latest unread messages via Microsoft Graph; caches access tokens and
  persists rotated refresh tokens
- Widget is hidden until the mailbox is actually authorized, so it
  stays out of sight while (admin) consent is pending
- New external card for Outlook (Office 365) with the official icon
- compose: pass OUTLOOK_CLIENT_ID/OUTLOOK_TENANT/GITEA_TOKEN from .env
- README: Entra ID app registration steps and the tenant-ID hint for
  directories not resolvable via the organizations endpoint

docker-entrypoint.sh

@@ -16,5 +16,9 @@ node /opt/dashboard/server.js &
 # First health-check sweep in the background; cron re-runs it every minute.
 ( cd /opt/dashboard && node update-health.js ) &
 
+# Outlook unread mail (no-op until OUTLOOK_CLIENT_ID is set and the device
+# login has been completed); cron re-runs it every minute.
+( cd /opt/dashboard && node update-outlook.js ) &
+
 # Start nginx in the foreground.
 exec nginx -g "daemon off;"