feat: Add Matrix infrastructure (Synapse + Element Web)

- Synapse homeserver.yaml configuration
- Element Web config.json
- PostgreSQL init script for synapse DB
- Nginx gateway configuration
- Docker Compose for Matrix stack
- README_MATRIX.md documentation

infra/matrix/gateway/matrix.conf

@@ -0,0 +1,64 @@
+# Nginx configuration for Matrix (Synapse + Element)
+# Add to /etc/nginx/conf.d/ on NODE1
+
+# Matrix Synapse API
+location /_matrix/ {
+    proxy_pass http://127.0.0.1:8008;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    
+    # WebSocket support
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    
+    # Increase timeouts for long-polling
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+    
+    # Increase body size for media uploads
+    client_max_body_size 50M;
+}
+
+# Synapse admin API (restrict access!)
+location /_synapse/ {
+    proxy_pass http://127.0.0.1:8008;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    
+    # Restrict to internal only
+    # allow 127.0.0.1;
+    # deny all;
+}
+
+# Element Web UI
+location /element/ {
+    alias /var/www/element/;
+    index index.html;
+    try_files $uri $uri/ /element/index.html;
+    
+    # Cache static assets
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}
+
+# .well-known for Matrix federation
+location /.well-known/matrix/server {
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '{"m.server": "matrix.daarion.space:443"}';
+}
+
+location /.well-known/matrix/client {
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '{"m.homeserver": {"base_url": "https://matrix.daarion.space"}, "m.identity_server": {"base_url": "https://vector.im"}}';
+}
+