feat(comms): P1 presence — minimal Synapse + fleet presence room + mosaic.presence heartbeat + liveness (#888)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

infra/matrix/appservice/mosaic-as.dev.yaml.tpl

@@ -0,0 +1,30 @@
+# ============================================================================
+# mosaic-as.dev.yaml.tpl — Mosaic Appservice registration (DEV)
+# ============================================================================
+#
+#   *** DEV-ONLY. The tokens below are throwaway placeholders rendered at
+#       bring-up by dev-up.sh. NEVER commit real hs_token/as_token — in
+#       production they are crown-jewel secrets held by the SecretBackend
+#       (RFC-001 §8, RFC-002 §4). ***
+#
+# This is the MINIMAL P1 registration: it declares the @agent-* user
+# namespace so the P1 provisioner can register a few virtual agent MXIDs and
+# carry heartbeats. It intentionally does NOT model the full P2 taxonomy /
+# token-minting appservice.
+#
+# Rendered by infra/matrix/dev-up.sh (envsubst -> .data/${MOSAIC_AS_ID}.yaml).
+# ----------------------------------------------------------------------------
+id: "${MOSAIC_AS_ID}"
+url: null                      # P1: provisioner drives the AS API directly; Synapse pushes no txns.
+as_token: "${MOSAIC_AS_TOKEN}"
+hs_token: "${MOSAIC_HS_TOKEN}"
+sender_localpart: "mosaic-as"
+rate_limited: false
+namespaces:
+  users:
+    - exclusive: true
+      regex: "@agent-.*:${MATRIX_SERVER_NAME}"
+  aliases:
+    - exclusive: false
+      regex: "#mosaic-.*:${MATRIX_SERVER_NAME}"
+  rooms: []