Follow-on Gmail and iCloud adapters

Duckbill™ keeps Microsoft Graph as the MVP mailbox. Gmail and iCloud prove the shared adapter port without delaying Graph processing.

Rules

Both adapters implement ProviderAdapter in packages/providers.
Gmail uses recorded fixtures and historyId incremental reads. Scopes are gmail.readonly then gmail.modify. Full mail.google.com is rejected.
iCloud is read-only IMAP inventory. Writes return CAPABILITY_NOT_SUPPORTED.
Account loops are independent. A Gmail outage cannot halt Graph.
Live Gmail or iCloud OAuth is not required for this stream. Do not put provider secrets in git or Jira.
ENABLE_SEND and ENABLE_DELETE stay false. AI never calls adapters.

HTTP

Inventory and dry-run routes live under /api/inventory/* and /api/migrations/*. They use recorded or mock adapters when no live follow-on tokens exist.

Code

Module	Role
`packages/providers/src/gmail/`	Gmail adapter, OAuth helpers, recorded transport
`packages/providers/src/icloud/`	IMAP inventory adapter and mock client
`packages/application/src/account-isolation.ts`	Independent account loops
`docs/decisions/0027-followon-providers-and-gated-inventory.md`	ADR 0027

Graph OAuth and live Microsoft connect stay on ADR 0011 / ADR 0015.