New `matrix` namespace and Flux KS: Synapse v1.162.0 on a CNPG Postgres (mx-pg, Barman to Hetzner), media store + signing key on synapse-data (Velero matrix-daily), Element Web locked to matrix.renner.uno, and an idempotent Job that creates the one owner account from OpenBao apps/matrix. Federation off, registration and guests closed, LAN-only ingress, egress limited to the in-cluster DB and the push gateway. Appservice slot left empty for REN-565 Part 2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>