matrix-synapse: restart the delegation nginx when its ConfigMap changes

The delegation nginx serves the .well-known documents from an nginx.conf that
is rendered from ingress.domain and mounted with subPath. Changing the domain
rewrote the ConfigMap but left the running pod untouched: the pod template was
unchanged, so nothing rolled, and the kubelet never refreshes a subPath mount.
The pod kept serving the old delegation while looking perfectly healthy - the
failure mode from #82.

The pod template now carries checksum/config over the rendered delegation
ConfigMap, so a changed nginx.conf rolls the deployment.

Also documents the limit that remains for homeserver.yaml: it comes from a
1Password-backed Secret, whose content Helm never sees, and the operator's own
auto-restart only ever covers Deployments - not this StatefulSet. That case
needs a manual rollout restart, which the values.yaml now says out loud.

Major bump: runtime behavior changes - a delegation config change now costs a
restart of the nginx pod (a few seconds, no persistent state).

matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml

@@ -14,6 +14,13 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
+      annotations:
+        # Hash of the rendered delegation ConfigMap: a changed nginx.conf
+        # changes the pod template and thus rolls the pods. Without it the
+        # running nginx keeps serving the old .well-known documents - the
+        # config is mounted with subPath (never refreshed by the kubelet) and
+        # nginx reads it only at start.
+        checksum/config: {{ include (print $.Template.BasePath "/matrix-delegation-nginx.configmap.yaml") . | sha256sum }}
     spec:
       automountServiceAccountToken: false
       securityContext: