fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/tasks/main.yml

@@ -13,6 +13,20 @@
       ess_rtc_external_ip in group_vars/ess_servers.yml.
     quiet: true
 
+- name: Validate ess_rtc_external_ip looks like an IP address
+  ansible.builtin.assert:
+    that:
+      # IPv4 dotted-quad or IPv6 (contains a colon). Cheap sanity check that
+      # avoids pulling in the ansible.utils collection just for ipaddr.
+      - >-
+        ess_rtc_external_ip is match('^\d{1,3}(\.\d{1,3}){3}$')
+        or ':' in ess_rtc_external_ip
+    fail_msg: >-
+      ess_rtc_external_ip ({{ ess_rtc_external_ip }}) is not a valid IP
+      address. LiveKit advertises this verbatim in ICE candidates; a bad
+      value silently breaks Element Call.
+    quiet: true
+
 - name: Validate OIDC variables when OIDC is enabled
   ansible.builtin.assert:
     that: