Mail setup inside the app: admins save the Microsoft app ID, secret and expiry in Settings, with the redirect address to copy, an expiry warning, and plain-language Microsoft errors

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/mail-setup.md

@@ -40,7 +40,9 @@ On the app's **Overview** page, copy the **Application (client) ID** (a long GUI
 
 ## 6. Give the hub the values
 
-Add these to your `.env` (or your stack's environment settings):
+**In the app (easiest):** sign in as an admin, open **Settings -> Microsoft app (admin)**. It shows the exact redirect address to register (with a Copy button), and has boxes for the Application (client) ID, the client secret Value and the date the secret expires. Press **Save**; Mail switches on straight away, no restart needed. The secret is stored encrypted on the server and is never shown again. NE Hub warns you in Settings, and with a push notification if you turned reminders on, in the month before the secret expires.
+
+**Or in the environment** (these win over anything saved in the app, and then the Settings box is read-only):
 
 ```
 MS_CLIENT_ID=<the Application (client) ID>
@@ -48,16 +50,12 @@ MS_CLIENT_SECRET=<the secret Value>
 PUBLIC_URL=https://hub.necloud.us
 ```
 
-Then redeploy the hub:
-
-```
-docker compose up -d
-```
-
-Leave `MS_CLIENT_ID` empty to switch Mail off.
+then redeploy with `docker compose up -d`. Leave both empty (and nothing saved in the app) to switch Mail off.
 
 ## 7. Connect
 
+Microsoft cannot check an app registration without a real sign-in, so the first Connect is the test: it checks the ID, the secret and the redirect address, and if something is wrong it says what. After one good connection, Settings -> Microsoft app shows the date of the last successful connection.
+
 1. Open the hub, go to **Mail**, and press **Connect Outlook.com**.
 2. Sign in with your Outlook.com account on Microsoft's page and approve the permissions.
 3. You land back on the Mail tab with your inbox showing.