matrix-synapse: restart the delegation nginx when its ConfigMap changes

The delegation nginx serves the .well-known documents from an nginx.conf that
is rendered from ingress.domain and mounted with subPath. Changing the domain
rewrote the ConfigMap but left the running pod untouched: the pod template was
unchanged, so nothing rolled, and the kubelet never refreshes a subPath mount.
The pod kept serving the old delegation while looking perfectly healthy - the
failure mode from #82.

The pod template now carries checksum/config over the rendered delegation
ConfigMap, so a changed nginx.conf rolls the deployment.

Also documents the limit that remains for homeserver.yaml: it comes from a
1Password-backed Secret, whose content Helm never sees, and the operator's own
auto-restart only ever covers Deployments - not this StatefulSet. That case
needs a manual rollout restart, which the values.yaml now says out loud.

Major bump: runtime behavior changes - a delegation config change now costs a
restart of the nginx pod (a few seconds, no persistent state).

matrix-synapse/values.yaml

@@ -5,6 +5,18 @@
 scaleDown: false
 
 secrets:
+  # homeserver.yaml is mounted into the Synapse StatefulSet from the Secret the
+  # 1Password operator materializes from this item.
+  #
+  # Known limitation (#82): a change to the item in the vault does NOT restart
+  # Synapse. Helm cannot hash the content (it never sees it - the operator fills
+  # the Secret in-cluster after rendering), so the checksum/config mechanism the
+  # delegation nginx uses does not apply here. The operator's own
+  # "operator.1password.io/auto-restart" annotation is no help either: it only
+  # ever restarts Deployments, and this workload is a StatefulSet (verified
+  # against onepassword-operator 1.12.0). After changing the item, restart
+  # Synapse by hand:
+  #   kubectl rollout restart statefulset <release>-matrix-synapse-sfs
   configSecretRef: null
 
 matrix: