M6.5: enroll matrix-synapse (recipe #4, DB+media/large-volume) — install verified green

install 2 passed on host (~2.7m): synapse client API 200 + real versions JSON, no extra config
(SYNAPSE_SERVER_NAME=DOMAIN). upgrade/backup author postgres-marker assertions exercising the
recipe's pg_backup.sh dump/restore hook (the meaningful matrix data path); verifying next.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/matrix-synapse/test_backup.py

@@ -0,0 +1,37 @@
+"""matrix-synapse — backup/restore stage (D2): write a postgres marker, backup (the recipe's
+pg_backup.sh pre-hook dumps the DB to backup.sql), mutate (drop the marker), restore (post-hook
+reloads the dump), assert the restored DB matches the pre-mutation state.
+
+This exercises the real DB-dump backup hook (backupbot.backup.pre-hook / restore.post-hook), not a
+plain volume copy — the meaningful data path for a postgres-backed app."""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+
+def _psql(domain, sql):
+    cmd = f'PGPASSWORD=$(cat /run/secrets/db_password) psql -U synapse -d synapse -tAc "{sql}"'
+    return lifecycle.exec_in_app(domain, ["sh", "-c", cmd], service="db").strip()
+
+
+def test_backup_mutate_restore(deployed, meta):
+    domain = deployed
+
+    # 1) establish original state in postgres, then back up (pg_backup.sh dumps the DB)
+    _psql(domain, "CREATE TABLE IF NOT EXISTS ci_marker(v text); DELETE FROM ci_marker; "
+                  "INSERT INTO ci_marker VALUES('original');")
+    assert _psql(domain, "SELECT v FROM ci_marker;") == "original"
+    lifecycle.backup_app(domain)
+
+    # 2) mutate: drop the marker table (diverge from the backup)
+    _psql(domain, "DROP TABLE ci_marker;")
+    assert _psql(domain, "SELECT to_regclass('public.ci_marker');") in ("", "NULL"), "drop did not take"
+
+    # 3) restore -> the dumped DB (with the marker) is reloaded
+    lifecycle.restore_app(domain)
+    lifecycle.wait_healthy(domain, ok_codes=tuple(meta["HEALTH_OK"]), path=meta["HEALTH_PATH"],
+                           deploy_timeout=meta["DEPLOY_TIMEOUT"], http_timeout=meta["HTTP_TIMEOUT"])
+    assert _psql(domain, "SELECT v FROM ci_marker;") == "original", \
+        "restore did not return the pre-mutation postgres state"