Mailbox Reconciler

A level-triggered loop that ensures every Keycloak realm user (optionally filtered to one group) has a mailcow mailbox, created with authsource=keycloak so the SSO door actually opens. Keeps a ledger of what IT created, so a user who disappears from the realm is expressible — but the destructive half is OFF by default: deletionPolicy=retain reports and never writes. This is the component that makes mail zero-touch.