fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/README.md

@@ -1,6 +1,6 @@
 # Ansible Role: ess_pro_compose
 
-Deploys the full **Element Server Suite Pro v26.5.1** stack as a single docker
+Deploys the full **Element Server Suite Pro v26.6.1** stack as a single docker
 compose project, modelled 1:1 on the official `matrix-stack` Helm chart from
 Element. Fronted by the existing DMZ Traefik, secrets sourced from OpenBao
 (plus locally-generated cryptographic material), same conventions as the
@@ -12,9 +12,9 @@ other `digitalboard.core` roles.
 
 ## Architecture
 
-12 services, mirroring the chart:
+10 base services (plus N federation-reader replicas), mirroring the chart:
 
-```
+```text
                                             ┌───────────────┐
               ┌──────────────────────HTTP──▶│   element-web │
               │                             └───────────────┘
@@ -149,6 +149,10 @@ curl -sS https://matrix.digitalboard.ch/_matrix/client/versions | jq .versions
 curl -sS https://digitalboard.ch/.well-known/matrix/server | jq
 curl -sS https://digitalboard.ch/.well-known/matrix/client | jq
 
+# MAS OIDC discovery must resolve (served by the MAS root listener on 8082,
+# routed separately from the web listener — see compose template).
+curl -sS https://account.digitalboard.ch/.well-known/openid-configuration | jq .issuer
+
 # MAS sanity
 docker compose -f /opt/ess/compose.yml exec mas \
   mas-cli --config /conf/mas-config.yaml doctor
@@ -171,7 +175,7 @@ docker compose -f /opt/ess/compose.yml exec haproxy \
 
 ## What's faithful to the chart, what's adapted
 
-**Faithful to chart v26.5.1:**
+**Faithful to chart v26.6.1:**
 - All image paths from `registry.element.io` (correct repos: `synapse-onprem`,
   `synapse-pro-worker`, `matrix-authentication-service`, `element-web-pro`,
   `element-admin`, `haproxy`, `livekit-server-distroless`, `lk-jwt-service`,