Webmail is now Cypht (several accounts in one place) instead of Roundcube

- cypht/: official Cypht 2.13.0 on a SQLite file, served under /webmail/; workflow builds git.necloud.us/nate/hub-cypht
- the hub passes /webmail/ through behind the passkey sign-in and signs in to Cypht for you (CYPHT_PASSWORD)
- provider sign-in pages (Google, Microsoft) open in the whole window and return to the Mail tab; other links open in a new tab
- Gmail / Outlook.com / Office365 OAuth settings (Microsoft permissions patched to the current ones)
- Roundcube removed; README, compose and webmail tests updated

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -19,8 +19,10 @@ services:
       AUDIOBOOKS_SSO_SECRET: ${AUDIOBOOKS_SSO_SECRET:-}
       AUDIOBOOKS_SSO_URL: ${AUDIOBOOKS_SSO_URL:-}
       VERSE_URL: ${VERSE_URL:-https://versebyversewithnate.us/admin}
-      WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Roundcube below
-      ROUNDCUBE_URL: http://roundcube:80                     # the bundled Roundcube; the hub shows it at /webmail/ (it is not exposed to the internet)
+      WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Cypht below
+      WEBMAIL_BACKEND_URL: http://cypht:80                   # the bundled webmail (Cypht); the hub shows it at /webmail/ (it is not exposed to the internet)
+      CYPHT_USER: ${CYPHT_USER:-hub}                         # the webmail's login; the Mail tab signs in with it for you
+      CYPHT_PASSWORD: ${CYPHT_PASSWORD:-}
       PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
       ONLYOFFICE_JWT_SECRET: ${ONLYOFFICE_JWT_SECRET:-}    # same value as the OnlyOffice server's JWT secret
       PUBLIC_URL: ${PUBLIC_URL:-}                           # e.g. https://hub.necloud.us (OnlyOffice posts saved edits here)
@@ -28,27 +30,33 @@ services:
       SESSION_DAYS: ${SESSION_DAYS:-180}                     # how long you stay signed in when idle; using the app renews it
       COOKIE_SECRET: ${COOKIE_SECRET:-}                     # optional; auto-generated and kept in /data if empty
     depends_on:
-      - roundcube
+      - cypht
     volumes:
       - hub-data:/data   # passkeys, calendar links and the session secret live here
 
-  # Webmail shown inside the Mail tab. Only the hub can reach it (no published port), so it sits behind the passkey sign-in.
-  # Sign in to it with your mail address and an app password (Gmail, iCloud and Yahoo are preset in roundcube/hub.php).
-  roundcube:
-    image: git.necloud.us/nate/hub-roundcube:latest   # built by the Gitea workflow from ./roundcube; `docker compose build` builds locally instead
-    build: ./roundcube
+  # Webmail shown inside the Mail tab (Cypht: several mail accounts in one place). Only the hub can reach it (no published port),
+  # so it sits behind the passkey sign-in. Add your accounts once inside it (Gmail, iCloud, Outlook.com, Office365, Yahoo and others are presets).
+  cypht:
+    image: git.necloud.us/nate/hub-cypht:latest   # built by the Gitea workflow from ./cypht; `docker compose build` builds locally instead
+    build: ./cypht
     restart: unless-stopped
     environment:
-      # Microsoft 365 sign-in (optional, see README -> Mail). Leave empty to skip.
-      M365_CLIENT_ID: ${M365_CLIENT_ID:-}
-      M365_CLIENT_SECRET: ${M365_CLIENT_SECRET:-}
-      M365_TENANT: ${M365_TENANT:-}
+      AUTH_USERNAME: ${CYPHT_USER:-hub}
+      AUTH_PASSWORD: ${CYPHT_PASSWORD:?Choose a password for the webmail and set CYPHT_PASSWORD}   # the hub also uses it to sign you in
       PUBLIC_URL: ${PUBLIC_URL:-}
+      # Sign in with Google / Microsoft instead of an app password (optional, see README -> Mail). Leave empty to skip.
+      GMAIL_CLIENT_ID: ${GMAIL_CLIENT_ID:-}
+      GMAIL_CLIENT_SECRET: ${GMAIL_CLIENT_SECRET:-}
+      OUTLOOK_CLIENT_ID: ${OUTLOOK_CLIENT_ID:-}        # personal Outlook.com / Hotmail
+      OUTLOOK_CLIENT_SECRET: ${OUTLOOK_CLIENT_SECRET:-}
+      OFFICE365_CLIENT_ID: ${OFFICE365_CLIENT_ID:-}    # work or school Microsoft 365
+      OFFICE365_CLIENT_SECRET: ${OFFICE365_CLIENT_SECRET:-}
+      M365_TENANT: ${M365_TENANT:-}
     volumes:
-      - roundcube-data:/var/roundcube/db   # address book, settings and the encryption key
+      - cypht-data:/var/lib/hm3   # the webmail's database: your accounts and settings
 
 volumes:
   hub-data:
     name: nehub-data   # fixed name so the data survives redeploys and renamed stacks
-  roundcube-data:
-    name: nehub-roundcube
+  cypht-data:
+    name: nehub-cypht