feat: deploy client-side ClamAV scan service for encrypted rooms

Synapse's own media-scanning module (Issue #19) can never see E2EE
attachment content - a structural limit, not a bug. This adds a small
standalone HTTP wrapper around the same ClamAV instance, reachable
from browser JS at /_scan, so the ThreadNet-Web client fork can scan
plaintext both before encrypting/uploading and after downloading/
decrypting - covering both directions regardless of room encryption.
Auth via Synapse's own /whoami endpoint, no separate auth system.

apps/production/networkpolicy.yaml

@@ -118,6 +118,15 @@ spec:
       ports:
         - protocol: TCP
           port: haproxy-synapse
+    # Client-Scan-Dienst (Issue #19-Erweiterung) validiert Access-Tokens gegen Synapses
+    # eigenen /whoami-Endpoint statt eine eigene Auth zu bauen.
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: clamav-http-scanner
+      ports:
+        - protocol: TCP
+          port: haproxy-synapse
 ---
 # account.axion1337.chat (Traefik) + matrix.axion1337.chat (also routes to MAS for some
 # paths) + synapse-main calling MAS's internal port for session/token introspection.
@@ -322,6 +331,31 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: synapse-main
+        # Client-seitiger Scan-Dienst (Issue #19-Erweiterung) braucht denselben ClamAV.
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: clamav-http-scanner
       ports:
         - protocol: TCP
           port: clamd
+---
+# axion1337.chat/_scan (Traefik) - client-seitiger Scan-Dienst, direkt vom Browser aufgerufen.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-clamav-http-scanner
+  namespace: matrix
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: clamav-http-scanner
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: TCP
+          port: http