ESS: 26.4.0 -> 26.8.0 (#0051)

The CVE gain is the smallest of today's steps: 17 critical findings become 6 and
217 high become 120 across Synapse, MAS, element-admin and lk-jwt-service.

The real reason is in the Synapse changelog rather than the CVE column. v1.157.0
fixes a bug introduced in v1.150.0 where reactivating a deactivated and erased
user did not restore their profile, breaking login, name changes and invitations.
We run v1.151.0, inside that range, and that is precisely what happened to an
account this morning.

Everything breaking in the span was checked against our state and none of it
applies: no Synapse workers, the stable auth integration already in use rather
than MSC3861, and no livekitAuth values set. Our elementWeb override to the fork
survives — both chart versions were rendered with our real values and compared.

Not 26.8.1: it appeared today. A fresh backup of the Synapse and MAS databases
plus media was taken by hand beforehand, and sorb holds a host snapshot.

apps/production/element-server-suite.yaml

@@ -12,7 +12,23 @@ spec:
   chart:
     spec:
       chart: matrix-stack
-      version: "26.4.0"
+      # 26.8.0 (management #0051). Bringt Synapse v1.158.0, MAS 1.22.0,
+      # element-admin 0.1.12, lk-jwt-service 0.4.4 und LiveKit-SFU v1.12.0.
+      #
+      # NICHT 26.8.1: die erschien am 2026-08-21, also am Tag dieses Sprungs.
+      #
+      # Der Grund steht nicht in der CVE-Spalte (17 -> 6 CRITICAL, 217 -> 120 HIGH),
+      # sondern in Synapse v1.157.0: 'Fix a bug introduced in Synapse v1.150.0 where
+      # reactivating a deactivated and erased user did not restore their profile,
+      # breaking login, name changes, and invitations.' Wir fuhren v1.151.0 - das war
+      # die Ursache des Vorfalls vom 2026-08-21 (AAR clark-calls-reset).
+      #
+      # Alle Bruchstellen der Spanne gegen unseren Stand geprueft und gegenstandslos:
+      # keine Synapse-Worker (v1.152, ESS 26.5.0), stabile MAS-Integration statt
+      # MSC3861 bereits in Gebrauch (v1.157), kein livekitAuth.keysYaml (26.8.1).
+      # Unsere elementWeb-Ueberschreibung auf threadnet-web ueberlebt - beide
+      # Chart-Fassungen wurden mit unseren echten Werten gerendert und verglichen.
+      version: "26.8.0"
       sourceRef:
         kind: HelmRepository
         name: element-ess-oci