fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/defaults/main.yml

@@ -3,14 +3,14 @@
 # =============================================================================
 # ess_pro_compose role — defaults
 # =============================================================================
-# Deploys the full ESS Pro stack (matrix-stack chart v26.5.1) as a docker
+# Deploys the full ESS Pro stack (matrix-stack chart v26.6.1) as a docker
 # compose project, including the Pro federation-reader worker. Same conventions
 # as the other digitalboard.core roles. Secrets are sourced from OpenBao.
 
 # -----------------------------------------------------------------------------
 # Chart version we're modelling
 # -----------------------------------------------------------------------------
-ess_chart_version: "26.5.1"
+ess_chart_version: "26.6.1"
 
 # -----------------------------------------------------------------------------
 # Project layout on the target host
@@ -50,23 +50,24 @@ ess_hostnames:
   matrix_rtc: "mrtc.{{ ess_server_name }}"      # Element Call SFU + auth
 
 # -----------------------------------------------------------------------------
-# Image references (Pro images from registry.element.io, chart 26.5.1)
+# Image references (Pro images from registry.element.io, chart 26.6.1)
 # -----------------------------------------------------------------------------
 # Pin to specific tags for production. The chart bundles digests; we use
 # version-aligned tags so they're readable. Override individually as needed.
+# Tags below are taken verbatim from matrix-stack 26.6.1 values.yaml.
 ess_images:
-  synapse: "registry.element.io/synapse-onprem:sha-63110a4"
-  synapse_pro_worker: "registry.element.io/synapse-pro-worker:0.4.0"
-  mas: "registry.element.io/matrix-authentication-service:1.17.0"
-  element_web: "registry.element.io/element-web-pro:1.12.18"
-  element_admin: "registry.element.io/element-admin:1.5.0"
+  synapse: "registry.element.io/synapse-onprem:v1.154.0-pro.1"
+  synapse_pro_worker: "registry.element.io/synapse-pro-worker:sha-63110a4"
+  mas: "registry.element.io/matrix-authentication-service-pro:1.18.0"
+  element_web: "registry.element.io/element-web-pro:v1.12.21"
+  element_admin: "registry.element.io/element-admin:0.1.11"
   haproxy: "registry.element.io/haproxy:3.2-alpine"
-  livekit: "registry.element.io/livekit-server-distroless:1.9.1"
-  lk_jwt: "registry.element.io/lk-jwt-service:0.3.0"
-  postgres: "registry.element.io/postgres:16-alpine"
-  postgres_exporter: "registry.element.io/postgres-exporter:0.18.1"
-  redis: "registry.element.io/redis-distroless:7.4"
-  matrix_tools: "registry.element.io/matrix-tools:0.17.8"
+  livekit: "registry.element.io/livekit-server-distroless:v1.12.0"
+  lk_jwt: "registry.element.io/lk-jwt-service:0.4.4"
+  postgres: "registry.element.io/postgres:17-alpine"
+  postgres_exporter: "registry.element.io/postgres-exporter:v0.18.1"
+  redis: "registry.element.io/redis-distroless:7.4-bookworm"
+  matrix_tools: "registry.element.io/matrix-tools:0.17.9"
 
 # -----------------------------------------------------------------------------
 # Element registry credentials (from customer.element.io)
@@ -147,3 +148,17 @@ ess_postgres_effective_cache_size: "3840MB"
 # -----------------------------------------------------------------------------
 ess_synapse_max_upload_size: "100M"
 ess_synapse_url_previews_enabled: true
+
+# -----------------------------------------------------------------------------
+# Redis
+# -----------------------------------------------------------------------------
+# Redis is pub/sub only (Synapse worker replication), no persistence. Chart
+# default is 40mb; bump only if you run many workers with heavy replication.
+ess_redis_maxmemory: "40mb"
+
+# -----------------------------------------------------------------------------
+# Element Web
+# -----------------------------------------------------------------------------
+# MapTiler style URL powering in-app location sharing. The chart ships this
+# shared demo key; swap for your own MapTiler key in production.
+ess_element_web_map_style_url: "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"