feat: real media antivirus scanning via custom Synapse module (Issue #19)

Deploys ClamAV and a small stdlib-only Synapse spam-checker module
implementing check_media_file_for_spam over clamd's INSTREAM protocol.
Unlike the originally-considered matrix-content-scanner proxy (which
needs client-side cooperation neither Element Web nor Element X
provide), this hooks Synapse's own module API directly - transparent
to every client for unencrypted media. No custom Synapse image needed:
the module is mounted via a ConfigMap onto PYTHONPATH using the ESS
chart's extraVolumes/extraVolumeMounts/extraEnv support. Fails open on
scanner errors so a ClamAV outage can't block all uploads.

apps/production/networkpolicy.yaml

@@ -303,3 +303,25 @@ spec:
 
 # Note: coturn runs with hostNetwork: true, so NetworkPolicy does not apply to it at all -
 # it's already gated by the Hetzner Cloud Firewall instead. Nothing to write here.
+---
+# ClamAV (Issue #19): only Synapse's check_media_file_for_spam module calls this, over
+# clamd's plain TCP protocol on port 3310. Nothing else needs to reach it.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-clamav
+  namespace: matrix
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: clamav
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: synapse-main
+      ports:
+        - protocol: TCP
+          port: clamd