feat: deploy client-side ClamAV scan service for encrypted rooms

Synapse's own media-scanning module (Issue #19) can never see E2EE
attachment content - a structural limit, not a bug. This adds a small
standalone HTTP wrapper around the same ClamAV instance, reachable
from browser JS at /_scan, so the ThreadNet-Web client fork can scan
plaintext both before encrypting/uploading and after downloading/
decrypting - covering both directions regardless of room encryption.
Auth via Synapse's own /whoami endpoint, no separate auth system.

apps/production/clamav-http-scanner-Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.13-slim
+
+COPY clamav-http-scanner.py /app/clamav-http-scanner.py
+
+USER nobody
+EXPOSE 8090
+
+CMD ["python3", "/app/clamav-http-scanner.py"]