fix(web-app-matrix): declare Element's forced device verification per variant

Element v1.12.33 (automated bump a8fba45d60) ships element-web #35364,
which turns force_verification on by default. From the second OIDC login
of an account on, Element stops on "Confirm your digital identity" with
no skip button, so the Matrix SSO specs (CI run 40625679270, Matrix#2:
DM and design specs, "administrator: authenticated Element UI" false
after 120 s) never reached the signed-in UI. Synapse kept the session
syncing the whole time; only the UI was gated.

services.element.force_verification now carries the platform default,
true as upstream, and both flavors render it (the compose element
config and the MDAD element configuration extension). Only variants 0
and 2, the SSO rounds whose specs log the same account in twice, set it
to false. Production keeps forced verification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-matrix/meta/services.yml

@@ -120,6 +120,7 @@ element:
   version: v1.12.33
   image: vectorim/element-web
   name: matrix-element
+  force_verification: true
   ports:
     local:
       http: 8022

roles/web-app-matrix/meta/variants.yml

@@ -19,6 +19,8 @@
       shared: false
     container_backup:
       enabled: true
+    element:
+      force_verification: false
     matrix:
       flavor: ansible
     n8n:
@@ -125,6 +127,8 @@
     container_backup:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    element:
+      force_verification: false
     matrix:
       flavor: compose
     n8n:

roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2

@@ -153,8 +153,8 @@ matrix_client_element_branding_auth_header_logo_url: {{ MATRIX_DESIGN_LOGO_URL |
 {% endif %}
 {% if MATRIX_DESIGN_ENABLED | bool %}
 matrix_client_element_branding_welcome_background_url: ""
-matrix_client_element_configuration_extension_json: '{"default_theme": null}'
 {% endif %}
+matrix_client_element_configuration_extension_json: {{ ({'force_verification': MATRIX_ELEMENT_FORCE_VERIFICATION | bool} | combine({'default_theme': none} if MATRIX_DESIGN_ENABLED | bool else {})) | to_json | to_json }}
 matrix_synapse_configuration_extension_yaml: |
   web_client_location: "{{ lookup('canonical_url', application_id, 'element') }}"
 

roles/web-app-matrix/templates/flavor/compose/element.config.json.j2

@@ -29,6 +29,7 @@
     "bug_report_endpoint_url": "https://element.io/bugreports/submit", {# nocheck: url #}
     "uisi_autorageshake_app": "element-auto-uisi",
     "show_labs_settings": true,
+    "force_verification": {{ MATRIX_ELEMENT_FORCE_VERIFICATION | bool | to_json }},
     "room_directory": {
         "servers": ["matrix.org", "gitter.im", "libera.chat"]
     },

roles/web-app-matrix/vars/main.yml

@@ -59,6 +59,7 @@ MATRIX_ELEMENT_DOMAIN: "{{ lookup('domains', application_id).element }}"
 MATRIX_ELEMENT_PORT: "{{ lookup('config', 'web-app-matrix', 'services.element.ports.local.http') }}"
 MATRIX_ELEMENT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.element.ports.internal.http') }}"
 MATRIX_ELEMENT_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'element-config.json' ] | path_join }}"
+MATRIX_ELEMENT_FORCE_VERIFICATION: "{{ lookup('config', application_id, 'services.element.force_verification') | bool }}"
 
 MATRIX_DESIGN_ENABLED: "{{ lookup('config', application_id, 'services.design.enabled') | bool }}"
 MATRIX_DESIGN_TITLE: "{{ (lookup('design', application_id).title or '') if MATRIX_DESIGN_ENABLED | bool else '' }}"