Authorize the mailbox owner and record the tenant
Use Microsoft identity to obtain the required delegated mail scopes, validate the returned identity, and bind tenant, user, and DewEngine account IDs. Do not infer ownership from an email address supplied before OAuth.