fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/tasks/postinstall.yml

@@ -3,12 +3,6 @@
 # Create @localadmin via mas-cli, using the ADMIN_USER_PASSWORD generated
 # by secrets.yml. Idempotent: mas-cli rejects duplicates, we ignore that.
 
-- name: Read generated admin password
-  ansible.builtin.slurp:
-    src: "{{ ess_compose_secrets_dir }}/ADMIN_USER_PASSWORD"
-  register: _ess_admin_pw_slurp
-  no_log: true
-
 - name: Check whether the admin user already exists
   ansible.builtin.command:
     cmd: >
@@ -20,16 +14,26 @@
   changed_when: false
   failed_when: false
 
+# The password is read from the secrets file *inside* the mas container (it is
+# already bind-mounted there read-only). Passing it as $(cat ...) inside the
+# container shell keeps it off the host's process list — only the host root can
+# read it anyway, but this avoids leaking it via `ps` during the exec.
 - name: Register admin user (mas-cli)
   ansible.builtin.command:
-    cmd: >
-      docker compose -f {{ _ess_compose_file }}
-      exec -T mas
-      mas-cli --config /conf/mas-config.yaml
-      manage register-user --yes
-      --password {{ (_ess_admin_pw_slurp.content | b64decode).strip() | quote }}
-      --admin
-      {{ ess_admin_localpart }}
+    argv:
+      - docker
+      - compose
+      - -f
+      - "{{ _ess_compose_file }}"
+      - exec
+      - -T
+      - mas
+      - sh
+      - -c
+      - >-
+        mas-cli --config /conf/mas-config.yaml manage register-user --yes
+        --password "$(cat /secrets/ess-generated/ADMIN_USER_PASSWORD)"
+        --admin {{ ess_admin_localpart | quote }}
   register: _ess_admin_create
   changed_when: "'created' in (_ess_admin_create.stdout + _ess_admin_create.stderr) | lower"
   failed_when: