Fixes:
- Pooled-provider messages are scoped to the inbox lifetime, so a recycled
  Outlook account no longer leaks the previous tenant's mail into /messages
  and /messages/:mid. Includes a UTC parsing fix for created_at.
- The dashboard's Recent Inboxes panel no longer walks the entire inboxes
  table; it takes one page of the newest rows.

Feature:
- Optional plus-address aliases for Outlook (POST /api/inbox {"alias":true}),
  with the tag generated server-side. An aliased request may reuse an account
  already used for that service.

Docs (re-cut 2026-07-27, same version):
- README, in-app API docs page and llms.txt cover the alias flag.
- Fixed two wrong rows in the in-app docs: 'for' is required, and
  'duration' is in seconds, not minutes.