fix(ess-pro/compose): align with matrix-stack 26.6.1 and fix routing/security gaps

Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/ess_pro_compose/templates/haproxy/haproxy.cfg.j2

@@ -98,7 +98,9 @@ frontend synapse-http-in
   use_backend return_204_rendezvous if { method OPTIONS } rendezvous
   use_backend return_204_synapse if { method OPTIONS }
 
-  # Failover from pro-fed-reader to main if the worker is unavailable
+  # Failover from pro-fed-reader to main if the worker is unavailable.
+  # The chart cascades pro-worker -> FOSS federation worker -> main; we deploy
+  # no FOSS federation worker, so we fail straight over to synapse-main.
   acl has_failover var(req.backend) -m str "pro-federation-api-requests"
   acl backend_unavailable str(),concat('synapse-',req.backend),nbsrv lt 1
   use_backend synapse-main-failover if has_failover backend_unavailable