Webmail is now Cypht (several accounts in one place) instead of Roundcube

- cypht/: official Cypht 2.13.0 on a SQLite file, served under /webmail/; workflow builds git.necloud.us/nate/hub-cypht
- the hub passes /webmail/ through behind the passkey sign-in and signs in to Cypht for you (CYPHT_PASSWORD)
- provider sign-in pages (Google, Microsoft) open in the whole window and return to the Mail tab; other links open in a new tab
- Gmail / Outlook.com / Office365 OAuth settings (Microsoft permissions patched to the current ones)
- Roundcube removed; README, compose and webmail tests updated

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cypht/Dockerfile

@@ -0,0 +1,19 @@
+# Cypht webmail for NE Hub: the official image, set up to run on its own SQLite file and to live under /webmail/ behind the hub.
+FROM cypht/cypht:2.13.0
+COPY nginx.conf /etc/nginx/nginx.conf
+# Cypht's Outlook.com / Microsoft 365 presets still ask for the retired 'wl.imap' permission; ask for the current IMAP and SMTP ones instead.
+RUN sed -i "s#'scope' => 'wl.imap'#'scope' => 'https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access'#" /usr/local/share/cypht/modules/nux/services.php \
+ && [ "$(grep -c 'IMAP.AccessAsUser.All' /usr/local/share/cypht/modules/nux/services.php)" = 2 ]
+COPY entrypoint.sh /hub-entrypoint.sh
+RUN mkdir -p /var/lib/hm3
+ENV DB_CONNECTION_TYPE=host \
+    DB_DRIVER=sqlite \
+    DB_NAME=/var/lib/hm3/cypht.sqlite \
+    SESSION_TYPE=PHP \
+    AUTH_TYPE=DB \
+    USER_CONFIG_TYPE=DB \
+    COOKIE_PATH=/webmail/ \
+    ALLOW_LONG_SESSION=true \
+    LONG_SESSION_LIFETIME=30
+VOLUME /var/lib/hm3
+ENTRYPOINT ["/hub-entrypoint.sh"]