fix(matrix): make the swarm deploy of both flavors converge and authenticate

Three layers of one chain. The CI verifier polled the service matrix_matrix, which no variant creates (the ansible flavor deploys a node-local MDAD runner, the compose flavor names its services matrix_synapse and friends); workload: node-local routes it to the established skip like bigbluebutton. Under swarm the stack deploy is a notified handler, so the registration wait started before any bridge existed and killed the play with the handler still pending; a flush before the wait deploys the stack first, and is a no-op in compose mode. Synapse resolves the OIDC issuer through two docker layers where both 127.0.0.1 and host-gateway point at the wrong loopback; the issuer now maps to the runner bridge's node gateway (local subnet .1), emitted only when OIDC is enabled so a no-auth setup keeps its previous arguments, proven by the full Playwright suite against the live cluster.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/web-app-matrix/meta/services.yml

@@ -109,6 +109,7 @@ matrix:
   name: matrix
   # nocheck: default-placement-manager  inner docker-in-docker storage; node-local in swarm
   placement: manager
+  workload: node-local
   flavor: ansible
   upstream:
     repo: https://github.com/spantaleev/matrix-docker-ansible-deploy

roles/web-app-matrix/tasks/flavor/compose/01_docker.yml

@@ -72,6 +72,9 @@
   include_tasks: 03_compose_pull_and_up.yml
   when: DEPLOYMENT_MODE == 'compose'
 
+- name: "🚿 Flush handlers so the swarm stack deploys before the registration wait"
+  meta: flush_handlers
+
 - name: ⏳ wait for registration files
   wait_for:
     path: "{{ lookup('container', application_id, 'directories.instance') }}mautrix/{{ item.bridge_name }}/registration.yaml"

roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2

@@ -56,12 +56,17 @@ jitsi_jicofo_container_network: host
 
 matrix_livekit_jwt_service_container_port: 8030
 
-{% if (TLS_MODE | lower) == 'self_signed' %}
+{% if MATRIX_OIDC_ENABLED or (TLS_MODE | lower) == 'self_signed' %}
 matrix_synapse_container_extra_arguments:
+{% if MATRIX_OIDC_ENABLED %}
+  - "--add-host={{ OIDC.CLIENT.ISSUER_URL | urlsplit('hostname') }}:{{ lookup('config', application_id, 'networks.local.subnet') | regex_replace('\\.0/\\d+$', '.1') }}"
+{% endif %}
+{% if (TLS_MODE | lower) == 'self_signed' %}
   - "--mount type=bind,src={{ CA_TRUST.cert_host }},dst={{ MATRIX_CA_MOUNT_PATH }},ro"
   - "-e SSL_CERT_FILE={{ MATRIX_CA_MOUNT_PATH }}"
   - "-e REQUESTS_CA_BUNDLE={{ MATRIX_CA_MOUNT_PATH }}"
 {% endif %}
+{% endif %}
 
 {% if MATRIX_COTURN_SHARED %}
 coturn_enabled: false