Webmail is now Cypht (several accounts in one place) instead of Roundcube

- cypht/: official Cypht 2.13.0 on a SQLite file, served under /webmail/; workflow builds git.necloud.us/nate/hub-cypht
- the hub passes /webmail/ through behind the passkey sign-in and signs in to Cypht for you (CYPHT_PASSWORD)
- provider sign-in pages (Google, Microsoft) open in the whole window and return to the Mail tab; other links open in a new tab
- Gmail / Outlook.com / Office365 OAuth settings (Microsoft permissions patched to the current ones)
- Roundcube removed; README, compose and webmail tests updated

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -20,10 +20,17 @@ AUDIOBOOKS_LOGIN_LINK=
 AUDIOBOOKS_SSO_SECRET=
 #AUDIOBOOKS_SSO_URL=https://audiobooks.necloud.us/sso
 
-# Optional: a webmail you run elsewhere, to show in the Mail tab instead of the bundled Roundcube (it must allow framing). Leave blank normally. See README (Mail).
+# Optional: a webmail you run elsewhere, to show in the Mail tab instead of the bundled Cypht (it must allow framing). Leave blank normally. See README (Mail).
 WEBMAIL_URL=
 
-# Microsoft 365 sign-in for the bundled webmail (optional; see README -> Mail for the Entra app registration)
-M365_CLIENT_ID=
-M365_CLIENT_SECRET=
+# Webmail (Cypht) login. Choose a password; the Mail tab signs in with it for you. Required.
+CYPHT_PASSWORD=
+#CYPHT_USER=hub
+# Sign in with Google / Microsoft instead of app passwords (optional; see README -> Mail)
+GMAIL_CLIENT_ID=
+GMAIL_CLIENT_SECRET=
+OUTLOOK_CLIENT_ID=
+OUTLOOK_CLIENT_SECRET=
+OFFICE365_CLIENT_ID=
+OFFICE365_CLIENT_SECRET=
 M365_TENANT=