refactor(mail): send via the SSO app registration, drop SMTP basic auth

Mail now uses the same Entra ID app registration as "Sign in with
Microsoft" (ENTRA_TENANT_ID, ENTRA_CLIENT_ID, ENTRA_CLIENT_SECRET), so
only one enterprise application is needed. The app additionally gets
the SMTP.SendAsApp permission; Exchange still limits it to the mailbox
granted via Add-MailboxPermission.

Password (basic auth) sending is removed entirely: SMTP_HOST, SMTP_PORT,
SMTP_PASSWORD and the separate SMTP_OAUTH_* settings are gone. The
transport is fixed to smtp.office365.com:587 with required STARTTLS.
SMTP_USER (sending mailbox) and SMTP_FROM remain.

- lib/entra.ts exposes readEntraAppCredentials(), shared by SSO and mail
- diagnosis drops basic-auth-only causes; hints name the ENTRA_* values
  and warn that an expired secret breaks sign-in and mail together
- admin e-mail test, .env.example, docker-compose, k8s manifests,
  preflight and README updated

Verified against Entra ID with fake values: token error classified,
client secret never exposed, missing ENTRA_CLIENT_SECRET reported.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/i18n/dictionaries/en.ts

@@ -1233,7 +1233,7 @@ export const en: Dictionary = {
   },
   adminEmailTestPage: {
     title: "Test email delivery",
-    intro: "Connects to the mail server, signs in with SMTP_USER and sends a test email to your own address. If something fails, you see the mail server message and what to do (the explanation is in German).",
+    intro: "Gets a token via the “Sign in with Microsoft” app registration, signs in to Microsoft 365 as SMTP_USER and sends a test email to your own address. If something fails, you see the mail server message and what to do (the explanation is in German).",
     button: "Send test email",
     running: "Testing …",
     success: (to) => `Delivery works. The test email is on its way to ${to}.`,
@@ -1242,8 +1242,7 @@ export const en: Dictionary = {
     causeLabel: "What to do",
     detailLabel: "Mail server message",
     configLabel: "Settings used",
-    authModeOAuth: "OAuth 2.0 (app registration)",
-    authModePassword: "Password (basic auth)",
+    authModeOAuth: "Microsoft 365, OAuth 2.0 via the SSO app",
     missingLabel: "Missing settings",
   },
   adminWithdrawalsPage: {