fix(web-app-matrix): declare Element's forced device verification per variant

Element v1.12.33 (automated bump a8fba45d60, on main) ships element-web
#35364, which turns force_verification on by default. From the second
OIDC login of an account on, Element stops on "Confirm your digital
identity" with no skip button, so the Matrix SSO specs that log the same
account in twice (test-dm-admin-biber.js, test-design.js) never reach the
signed-in UI: "administrator: authenticated Element UI (user menu / room
list / welcome) must render" fails after 120 s (fork run 40625679270,
Matrix#2 and the co-deployed Moodle#2).

services.element.force_verification now carries the platform default,
true as upstream, and both flavors render it (the compose element config
and the MDAD element configuration extension). Only variants 0 and 2,
the SSO rounds, set it to false. Production keeps forced verification.

Cherry-picked from e042c9dbf9 on feature/store-i18n. main has no Element
branding block yet, so the MDAD flavor carries only the force_verification
key in its configuration extension.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-matrix/meta/services.yml

@@ -106,6 +106,7 @@ element:
   version: v1.12.33
   image: vectorim/element-web
   name: matrix-element
+  force_verification: true
   ports:
     local:
       http: 8022

roles/web-app-matrix/meta/variants.yml

@@ -3,6 +3,8 @@
 - services:
     container_backup:
       enabled: true
+    element:
+      force_verification: false
     matrix:
       flavor: ansible
     coturn:
@@ -93,6 +95,8 @@
     container_backup:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    element:
+      force_verification: false
     matrix:
       flavor: compose
     seaweedfs:

roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2

@@ -137,6 +137,7 @@ matrix_synapse_ext_password_provider_ldap_attributes_name: givenName
 
 matrix_client_element_enabled: true
 matrix_client_element_default_hs_url: "{{ MATRIX_SYNAPSE_URL }}"
+matrix_client_element_configuration_extension_json: {{ {'force_verification': MATRIX_ELEMENT_FORCE_VERIFICATION | bool} | to_json | to_json }}
 
 matrix_bridge_appservice_irc_enabled: {{ MATRIX_BRIDGE.appservice_irc | string | lower }}
 matrix_bridge_heisenbridge_enabled: {{ MATRIX_BRIDGE.heisenbridge | string | lower }}

roles/web-app-matrix/templates/flavor/compose/element.config.json.j2

@@ -21,6 +21,7 @@
     "bug_report_endpoint_url": "https://element.io/bugreports/submit", {# nocheck: url #}
     "uisi_autorageshake_app": "element-auto-uisi",
     "show_labs_settings": true,
+    "force_verification": {{ MATRIX_ELEMENT_FORCE_VERIFICATION | bool | to_json }},
     "room_directory": {
         "servers": ["matrix.org", "gitter.im", "libera.chat"]
     },

roles/web-app-matrix/vars/main.yml

@@ -58,6 +58,7 @@ MATRIX_ELEMENT_DOMAIN: "{{ lookup('domains', application_id).element }}"
 MATRIX_ELEMENT_PORT: "{{ lookup('config', 'web-app-matrix', 'services.element.ports.local.http') }}"
 MATRIX_ELEMENT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.element.ports.internal.http') }}"
 MATRIX_ELEMENT_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'element-config.json' ] | path_join }}"
+MATRIX_ELEMENT_FORCE_VERIFICATION: "{{ lookup('config', application_id, 'services.element.force_verification') | bool }}"
 
 MATRIX_MDAD_DIR: "{{ lookup('container', application_id, 'directories.instance') }}mdad"
 MATRIX_MDAD_RUNNER_BUILD_DIR: "{{ [ lookup('container', application_id, 'directories.instance'), 'runner' ] | path_join }}"