netpol: MAS reaches Synapse through haproxy now, and the rule did not know it

Until ESS 26.4.0 the auth service pointed straight at matrix-stack-synapse-main,
which allow-ingress-synapse permits, so nothing was needed here. ESS 26.8.0 moves
matrix.endpoint to the haproxy service — and MAS walked into the default-deny.
Login broke with 500 'failed to provision device' on /oauth2/token.

The rule was mine, from #0088 this morning. It named who may reach haproxy, and
the list was complete for the topology of that hour. A chart decided otherwise
six hours later.

apps/production/networkpolicy.yaml

@@ -109,6 +109,23 @@ spec:
           port: haproxy-403
         - protocol: TCP
           port: haproxy-wkd
+    # Matrix Authentication Service ruft Synapse ueber haproxy.
+    #
+    # ⚠️ Bis ESS 26.4.0 zeigte MAS DIREKT auf matrix-stack-synapse-main; dorthin
+    # erlaubt allow-ingress-synapse den Zugriff, hier war nichts noetig. ESS 26.8.0
+    # stellt matrix.endpoint auf den haproxy-Dienst matrix-stack-synapse um - und
+    # damit lief MAS in die default-deny-Regel. Folge: /oauth2/token antwortete mit
+    # 500 'failed to provision device', die Anmeldung brach ab (2026-08-21, #0051).
+    #
+    # Die Lehre steht im AAR: Eine Regel, die auf einen Dienstnamen zeigt, haengt an
+    # einer Entscheidung des Charts, nicht an unserer.
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: matrix-authentication-service
+      ports:
+        - protocol: TCP
+          port: haproxy-synapse
     # Draupnir (Issue #18) calls Synapse's client-server API directly, in-namespace -
     # without this it would be silently blocked by the default-deny policy.
     - from: