Live Microsoft connect

MAIL-21 / MAIL-229: a signed-in user can connect any Microsoft mailbox they authorize, without exposing tokens. Product copy does not cap the set at two named addresses.

Product path

Sign in with Apple at /login when application credentials are configured (ADR 0028).
Open /accounts (header Accounts) to list every owned connected_accounts row, or /connect (homepage Connect Microsoft). If there is no Apple session, the page may post /api/session/owner as an ops escape — not a second product IdP.
Connect Microsoft GETs /api/providers/microsoft/start and sends the browser to Microsoft. /accounts reuses that same start route.
Microsoft returns to /connect/microsoft/callback, which calls /api/providers/microsoft/callback. After success the browser returns to /accounts. The UI shows mailbox health only.

Scopes stay openid offline_access User.Read Mail.Read Mail.ReadWrite. Mail.Send is rejected.

Host environment

Set per preview and production. Do not commit values.

Variable	Purpose
`APP_ENV`	`preview` or `production` (enables Secure cookies)
`SESSION_SECRET`	32+ characters; signs `ia_session`
`DATABASE_URL`	Postgres for users, oauth state, accounts, tokens
`TOKEN_ENCRYPTION_KEY`	32+ characters; AES-256-GCM for provider tokens
`OWNER_SESSION_ENABLED`	`true` to allow the owner session POST
`OWNER_IDENTITY_SUBJECT`	e.g. `jason@jasonkoch.io`
`MICROSOFT_CLIENT_ID`	Entra app (delegated, `/common`)
`MICROSOFT_CLIENT_SECRET`	Entra client secret
`MICROSOFT_REDIRECT_URI`	`https://duckbill.jasonkoch.io/connect/microsoft/callback` (and the preview host equivalent)

Until SESSION_SECRET is set, /api/me and OAuth start return 503.

Azure app

Register a public client / web app in Entra. Redirect URIs must match MICROSOFT_REDIRECT_URI exactly. Enable Mail.Read and Mail.ReadWrite. Do not add Mail.Send.