chore: upgrade to 7.2.0+v1.154.0

- synapse v1.149.1 -> v1.154.0
- nginx 1.29.6 -> 1.31.1
- matrix-authentication-service 1.14.0 -> 1.18.0
- pgautoupgrade 17 -> 18, pin PGDATA to legacy path for in-place upgrade

.env.sample

@@ -105,7 +105,7 @@ ENABLE_REGISTRATION=false
 SERVE_SERVER_WELLKNOWN=false
 
 # Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik.
-# Can be used when SERVER_NAME != DOMAIN and SERVER_NAME is served by Traefik.
+# Can be used when SERVER_NAME is other than DOMAIN and SERVER_NAME is served by Traefik.
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
 
 ALLOW_PUBLIC_ROOMS_FEDERATION=false
@@ -149,7 +149,6 @@ ENCRYPTED_BY_DEFAULT=all
 #SESSION_LIFETIME=60d
 #TRACK_PUPPETED_USER_IPS=true
 
-
 ## Room complexity limit (prevents joining large remote rooms that cause DB bloat)
 ## complexity ≈ state_events / 500. Default 100.0 blocks rooms with >50000 state events.
 #ROOM_COMPLEXITY_LIMIT=100.0
@@ -248,7 +247,6 @@ RETENTION_MAX_LIFETIME=4w
 ## Web Client (Redirect)
 #WEB_CLIENT_LOCATION=https://element-web.example.com
 
-
 ## State compression (reduces database bloat from federation)
 ## Runs synapse_auto_compressor daily, built from source on first start
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compress-state.yml"

compose.yml

@@ -114,7 +114,7 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "coop-cloud.${STACK_NAME}.version=7.3.0+v1.154.0"
+        - "coop-cloud.${STACK_NAME}.version=7.2.0+v1.154.0"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8008/health"]