ADR 0015: Live Microsoft connect on Duckbill hosts

Context

MAIL-63/64 shipped OAuth start/callback/revoke and encrypted token persist. ADR 0011 left preview and production returning 503 until Microsoft and database secrets were set. MAIL-21 stayed open because no real mailbox was authorized and there was no Connect control.

Decision

• Add /connect with a Connect Microsoft control. Do not put a typed ™ next to the header lockup.
• Issue a single-user owner session (POST /api/session/owner) when OWNER_SESSION_ENABLED is true and OWNER_IDENTITY_SUBJECT is set. This is not an IdP. It satisfies ADR 0005: a session is issued only after a persisted user_id exists.
• Microsoft redirect URI is /connect/microsoft/callback. That page calls the existing callback API and refuses to render a body that looks like it contains tokens.
• Required host secrets stay out of git: SESSION_SECRET, DATABASE_URL, TOKEN_ENCRYPTION_KEY, MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_REDIRECT_URI.

Alternatives

• Keep JSON-only OAuth routes with no product surface — rejected; MAIL-21 is a user goal.
• Add Auth0/Clerk — rejected; ADR 0005 still holds for application login.

Consequences

MAIL-21 is Done only after a real Microsoft mailbox is authorized on a Duckbill host and tokens stay off the browser. MAIL-63/64 remain the scaffold.