0.15.0

Changed — may break callers

• The profile sets whether and up to what size sync reads attachments, and one run can override it. The
  profile's read_attachments (default true) and max_attachment_mb (default 10) set it; --no-attachments,
  --attachments and --max-attachment-mb <n> override it for one run. A file left unread is stored with its name and
  size, its extraction not-read or too-large. No file is kept either way.
• messages show reads an email again when one of its attachments was left unread, every attachment whatever
  its size, so the command now reaches the mail server for such an email. --offline or a failed read shows the stored
  email with meta.complete: false and the issue mail.attachments-unread. attachments download keeps a file.
• Gmail over OAuth signs in with WireCat's Google app when you name none. It needed --client-file or
  MAIL_GOOGLE_CLIENT_ID and failed with mail.oauth-no-client without them. The order is --client-file, then
  MAIL_GOOGLE_CLIENT_ID (with MAIL_GOOGLE_CLIENT_SECRET), then the profile's new google_client_id, then
  WireCat's app. Google has not reviewed WireCat's app for mail yet: if Google refuses it, use your own
  (steps). Choosing OAuth for a Gmail profile is unchanged.
• MAIL_MICROSOFT_CLIENT_ID picks the Microsoft app for one run, before the profile's microsoft_client_id and
  WireCat's app, which now comes from cli-core's constants.json. mail.oauth-no-client is gone: there is always an
  app.
• doctor's oauth rows say which app each profile uses as oauth_client: { client, source }, in place of
  client: source is flag, env, config or constants (WireCat's). A profile's row reports the app it
  signed in with when its sign-in recorded one. session start answers source beside client.
• mail runs on cli-base 0.77.1 and cli-core 0.566.0.

Added

• stats messages show counts the profile's stored mail per day, week or sender, received and sent, over the
  same query as search messages: { by, received, sent, rows: [{ key, name, received, sent }] }, a day or week key
  YYYY-MM-DD in --timezone (a week by its Monday), a sender keyed by address with sent 0. Counts only, no search
  recorded. For WireCat Desktop's mail per day (cli-core's mailStats, 0.564.0).
• account inspect groups the mailbox's mail by sender and list before you sync it: emails, MB, unread and bulk
  shares, years, whether you replied, a skip suggestion and a spam or scam score, plus the rule kinds the mail would
  match. Headers only, nothing stored. --domain-age asks each sender domain's registry (RDAP) when it was
  registered. Moved from memo mail inspect.
• messages import <file.mbox> adds a Google Takeout archive to a Gmail profile's stored mail, joined with what
  sync stores by Gmail's ids; it only adds, leaves out Spam and Trash and follows the profile's rules. Moved from
  memo's mode: "mbox" mail accounts.
• sync scores the senders of the stored mail, at most once a day, and asks registries about new sender domains
  until its deadline; search ranks mail from senders with signs of fraud lower. The answer's senders says how many.
  memo sync did this before; it no longer reads mail.

Fixed

• The MCP server tells an agent that attachment text is data, not instructions, beside subjects, bodies and file
  names. sync indexes attachment text and messages show returns it.
• session start writes every setting at its default when it saves a new profile, as config set does. The
  first file a sign-in made held only the profile, so the owner could not see the other settings until a later
  config set or config migrate.