Add Outlook unread-mail widget with device-code login

- outlook-auth.js: one-time device-code flow against Microsoft login;
  stores the refresh token in the outlook-tokens compose volume
- update-outlook.js: per-minute cron fetching the unread count and the
  latest unread messages via Microsoft Graph; caches access tokens and
  persists rotated refresh tokens
- Widget is hidden until the mailbox is actually authorized, so it
  stays out of sight while (admin) consent is pending
- New external card for Outlook (Office 365) with the official icon
- compose: pass OUTLOOK_CLIENT_ID/OUTLOOK_TENANT/GITEA_TOKEN from .env
- README: Entra ID app registration steps and the tenant-ID hint for
  directories not resolvable via the organizations endpoint

nginx.conf

@@ -18,6 +18,11 @@ server {
         add_header Cache-Control "no-cache" always;
     }
 
+    # Outlook unread mail; refreshed every minute by cron.
+    location = /outlook.json {
+        add_header Cache-Control "no-cache" always;
+    }
+
     # Open WebUI chat proxy.
     location /api/chat {
         proxy_pass         http://127.0.0.1:3001;