Harden Dockerfile and integrate worker orchestration

[jevonearth]

Summary

• Dockerfile hardening: Drop gcc/pysodium build deps (PyNaCl with bundled libsodium is already in the base image), tighten PDU size patch to exact line match with build-time guard, add --no-install-recommends
• Worker orchestration: Integrate official Element HQ configure_workers_and_start.py (supervisord + nginx + redis, all in-container) replacing our static 4-worker config. Workers are dynamically generated from SYNAPSE_WORKER_TYPES env var
• Entrypoint rewrite: Single mode execs Synapse directly (no synctl), worker mode execs configure_workers_and_start.py. Listener port/bind set automatically per mode
• homeserver.yaml cleanup: Removed instance_map, redis, and replication listener blocks (generated dynamically in worker mode). Added ${SYNAPSE_HTTP_PORT} / ${SYNAPSE_HTTP_BIND} template vars
• CI: Push images on PR and branch push (not just semver tags)

All security hardening is preserved: SSRF federation_ip_range_blacklist, crypto_auth_provider.py v0.3, beacon_monitor_module.py, logfmt logging, password_config: false.

Usage

# Single-process (default)
docker compose -f docker-compose.example.yml up --build

# Worker mode
SYNAPSE_WORKERS=true docker compose -f docker-compose.example.yml up --build

# Custom worker types
SYNAPSE_WORKERS=true SYNAPSE_WORKER_TYPES="synchrotron:4,event_persister:2,federation_inbound:2" \
  docker compose -f docker-compose.example.yml up --build

What's new in the image

Package	Purpose
nginx-light	Reverse proxy routing requests to workers
redis-server	Inter-process replication
supervisor	Process management for main + workers

Prometheus service discovery at :9469/metrics/service_discovery when SYNAPSE_ENABLE_METRICS=1.