feat: real media antivirus scanning via custom Synapse module (Issue #19)

Deploys ClamAV and a small stdlib-only Synapse spam-checker module
implementing check_media_file_for_spam over clamd's INSTREAM protocol.
Unlike the originally-considered matrix-content-scanner proxy (which
needs client-side cooperation neither Element Web nor Element X
provide), this hooks Synapse's own module API directly - transparent
to every client for unencrypted media. No custom Synapse image needed:
the module is mounted via a ConfigMap onto PYTHONPATH using the ESS
chart's extraVolumes/extraVolumeMounts/extraEnv support. Fails open on
scanner errors so a ClamAV outage can't block all uploads.

apps/production/custom-configs/synapse-values.yaml

@@ -10,6 +10,22 @@ data:
         rootLevel: INFO
         levelOverrides:
           synapse.media.url_previewer: DEBUG
+      # ClamAV media scanning module (Issue #19) - mounted read-only from a ConfigMap
+      # (synapse-clamav-module) since the container runs with a read-only root filesystem
+      # and we avoid a custom Synapse image; PYTHONPATH picks it up for the `modules:`
+      # block below.
+      extraVolumes:
+        - name: clamav-spam-checker
+          configMap:
+            name: synapse-clamav-module
+      extraVolumeMounts:
+        - name: clamav-spam-checker
+          mountPath: /extra-modules/clamav_spam_checker.py
+          subPath: clamav_spam_checker.py
+          readOnly: true
+      extraEnv:
+        - name: PYTHONPATH
+          value: /extra-modules
       additional:
         url-previews:
           config: |
@@ -60,4 +76,11 @@ data:
                 action: allow
         oembed:
           config: |
-            oembed_enabled: true
+            oembed_enabled: true
+        clamav-module:
+          config: |
+            modules:
+              - module: clamav_spam_checker.ClamAVSpamChecker
+                config:
+                  clamd_host: "clamav.matrix.svc.cluster.local"
+                  clamd_port: 3310