Mail: account cards, choose which mail apps to show, optional framed webmail

- Mail page redesigned as one card per account (inbox + compose)
- Settings -> Mail apps: tick the apps you use; saved on the server per person
- WEBMAIL_URL shows your own webmail (e.g. Roundcube) inside the Mail tab; provider shortcuts one tap away
- README: Roundcube setup and framing headers

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -55,8 +55,24 @@ e.g. hub.necloud.us. Settings: `SEAFILE_URL`, `ONLYOFFICE_URL` env vars in docke
   `{u, id, exp, n}` and `sig` is the base64url HMAC-SHA256 of `body`. Without either, the plain site opens and the saved username can be copied.
 - **Podcast** and **Podcast Admin**: launchers that open `PODCAST_URL` (a home-network address) and `VERSE_URL` in their own tabs.
 - **Office**: embeds onlyoffice.necloud.us in a frame, with an "open in new tab" fallback if it blocks framing.
-- **Mail**: deep links to Gmail, Outlook.com, Microsoft 365 and iCloud webmail (inbox + compose).
-  Providers forbid framing, and a real unified inbox would need Google/Azure app registrations.
+- **Mail**: with `WEBMAIL_URL` set, your own webmail opens inside the app (a frame that keeps running between tabs, with reload, full screen and open-in-new-tab);
+  a button there opens the Gmail / Outlook.com / Microsoft 365 / iCloud shortcuts. Without it, Mail is those shortcuts (inbox + compose, only for the apps you tick
+  in Settings -> Mail apps). Gmail, iCloud and Outlook refuse to be framed, so to read all your accounts in the app, run a webmail you control and connect it to them
+  over IMAP (Gmail and iCloud with an app-specific password). Roundcube example:
+
+      roundcube:
+        image: roundcube/roundcubemail:latest-apache
+        environment:
+          ROUNDCUBEMAIL_DEFAULT_HOST: ssl://imap.gmail.com      # or imap.mail.me.com, etc.
+          ROUNDCUBEMAIL_DEFAULT_PORT: 993
+          ROUNDCUBEMAIL_SMTP_SERVER: ssl://smtp.gmail.com
+          ROUNDCUBEMAIL_SMTP_PORT: 465
+          ROUNDCUBEMAIL_PLUGINS: archive,zipdownload
+        volumes: [ ./roundcube:/var/roundcube/config ]       # a file here can add the lines below
+
+  Put this in a config file there: `$config['x_frame_options'] = false;` `$config['imap_host'] = ['ssl://imap.gmail.com:993' => 'Gmail', 'ssl://imap.mail.me.com:993' => 'iCloud'];`
+  and have the reverse proxy for your webmail send `Content-Security-Policy: frame-ancestors https://<your hub address>` (and no `X-Frame-Options`), so only the hub can frame it.
+  Keep the webmail on the same site as the hub (for example mail.necloud.us and hub.necloud.us) so its sign-in cookie works inside the frame.
 
 ## Install on iPhone / iPad (PWA)