feat: unified messaging TUI MVP — Synapse + 7 mautrix bridges + Textual TUI + MCP draft staging

One-command local stack: cp .env.example .env && make up. Idempotent
bootstrap renders Synapse + bridge configs from pristine upstream examples,
provisions databases, registrations, double puppeting, and the admin user.
Textual TUI with bridge manager, in-terminal QR login, and drafts panel.
MCP server exposes read tools and a human-gated draft send workflow.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bootstrap/provision.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# One-shot post-synapse provisioning: create admin user (idempotent) and
+# write /data/shared/credentials.json for the TUI and MCP server.
+set -euo pipefail
+
+DATA=/data
+DOMAIN=${MATRIX_SERVER_NAME:-localhost}
+USER=${MATRIX_USER:-admin}
+PASS=${MATRIX_PASSWORD:?}
+MXID="@${USER}:${DOMAIN}"
+HS=http://synapse:8008
+REG_SECRET=$(cat $DATA/secrets/registration_shared_secret 2>/dev/null || true)
+
+log() { echo "[provision] $*"; }
+
+# already provisioned and token still valid? then no-op
+if [ -f "$DATA/shared/credentials.json" ]; then
+  TOK=$(yq -p json '.access_token' "$DATA/shared/credentials.json")
+  if curl -sf -H "Authorization: Bearer $TOK" "$HS/_matrix/client/v3/account/whoami" >/dev/null; then
+    log "credentials already valid, nothing to do"
+    exit 0
+  fi
+fi
+
+login() {
+  curl -sf -X POST "$HS/_matrix/client/v3/login" \
+    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"$USER\"},\"password\":$(python3 -c "import json,sys;print(json.dumps(sys.argv[1]))" "$PASS"),\"initial_device_display_name\":\"provision\"}"
+}
+
+RESP=$(login || true)
+if [ -z "$RESP" ]; then
+  log "admin user missing, registering $MXID"
+  NONCE=$(curl -sf "$HS/_synapse/admin/v1/register" | yq -p json '.nonce')
+  MAC=$(printf '%s\0%s\0%s\0admin' "$NONCE" "$USER" "$PASS" | openssl dgst -sha1 -hmac "$REG_SECRET" | awk '{print $NF}')
+  RESP=$(python3 - "$NONCE" "$USER" "$PASS" "$MAC" <<'EOF' | curl -sf -X POST "$HS/_synapse/admin/v1/register" -d @-
+import json, sys
+n, u, p, m = sys.argv[1:5]
+print(json.dumps({"nonce": n, "username": u, "password": p, "admin": True, "mac": m}))
+EOF
+  )
+  [ -n "$RESP" ] || { log "registration failed"; exit 1; }
+fi
+
+TOKEN=$(echo "$RESP" | yq -p json '.access_token')
+DEVICE=$(echo "$RESP" | yq -p json '.device_id')
+
+python3 - "$HS" "$MXID" "$PASS" "$TOKEN" "$DEVICE" <<'EOF' > $DATA/shared/credentials.json.new
+import json, sys
+hs, mxid, pw, tok, dev = sys.argv[1:6]
+print(json.dumps({"homeserver": hs, "user_id": mxid, "password": pw,
+                  "access_token": tok, "device_id": dev}, indent=2))
+EOF
+mv $DATA/shared/credentials.json.new $DATA/shared/credentials.json
+chmod a+rw $DATA/shared/credentials.json
+log "credentials written for $MXID"