chore: upgrade bridges + bridge DBs

signalbridge: v0.8.7 -> v0.2606.0 (calver scheme change, already Go-based)
telegrambridge: v0.15.3 -> v0.2606.0 (Python->Go bridgev2 rewrite; config template rewritten)
signaldb/telegramdb/discorddb: postgres 13-alpine -> 14-alpine (PG13 EOL; conservative one-major bump)
.env.sample: TELEGRAM_BRIDGE_PERMISSIONS relaybot -> relay (Go bridgev2 permission rename)

.env.sample

@@ -105,7 +105,7 @@ ENABLE_REGISTRATION=false
 SERVE_SERVER_WELLKNOWN=false
 
 # Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik.
-# Can be used when SERVER_NAME != DOMAIN and SERVER_NAME is served by Traefik.
+# Can be used when SERVER_NAME is other than DOMAIN and SERVER_NAME is served by Traefik.
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
 
 ALLOW_PUBLIC_ROOMS_FEDERATION=false
@@ -149,7 +149,6 @@ ENCRYPTED_BY_DEFAULT=all
 #SESSION_LIFETIME=60d
 #TRACK_PUPPETED_USER_IPS=true
 
-
 ## Room complexity limit (prevents joining large remote rooms that cause DB bloat)
 ## complexity ≈ state_events / 500. Default 100.0 blocks rooms with >50000 state events.
 #ROOM_COMPLEXITY_LIMIT=100.0
@@ -218,7 +217,7 @@ RETENTION_MAX_LIFETIME=4w
 #VERIFY_SSL=false
 #ENABLE_ENCRYPTION=true
 #TELEGRAM_APP_ID=
-#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relaybot\", \"@foo:matrix.example.com\": \"admin\" }"
+#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relay\", \"@foo:matrix.example.com\": \"admin\" }"
 #TELEGRAM_SYNC_CHANNEL_MEMBERS=true
 #SECRET_TELEGRAM_DB_PASSWORD_VERSION=v1
 #SECRET_TELEGRAM_API_HASH_VERSION=v1
@@ -248,7 +247,6 @@ RETENTION_MAX_LIFETIME=4w
 ## Web Client (Redirect)
 #WEB_CLIENT_LOCATION=https://element-web.example.com
 
-
 ## State compression (reduces database bloat from federation)
 ## Runs synapse_auto_compressor daily, built from source on first start
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compress-state.yml"

compose.discord.yml

@@ -30,7 +30,7 @@ services:
       - internal
 
   discorddb:
-    image: postgres:13-alpine
+    image: postgres:14-alpine
     secrets:
       - discord_db_password
     environment:

compose.mas.yml

@@ -5,7 +5,7 @@ version: "3.8"
 
 services:
   mas:
-    image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
+    image: ghcr.io/element-hq/matrix-authentication-service:1.19.0
     command: ["server", "--config=/etc/mas/config.yaml"]
     environment:
       - DOMAIN

compose.signal.yml

@@ -10,7 +10,7 @@ services:
       - signal-data:/signal-data
 
   signalbridge:
-    image: dock.mau.dev/mautrix/signal:v0.8.7
+    image: dock.mau.dev/mautrix/signal:v0.2606.0
     depends_on:
       - signaldb
     configs:
@@ -35,7 +35,7 @@ services:
       - internal
 
   signaldb:
-    image: postgres:13-alpine
+    image: postgres:14-alpine
     secrets:
       - signal_db_password
     environment:

compose.telegram.yml

@@ -10,7 +10,7 @@ services:
       - telegram-data:/telegram-data
 
   telegrambridge:
-    image: dock.mau.dev/mautrix/telegram:v0.15.3
+    image: dock.mau.dev/mautrix/telegram:v0.2606.0
     depends_on:
       - telegramdb
     configs:
@@ -40,7 +40,7 @@ services:
       - internal
 
   telegramdb:
-    image: postgres:13-alpine
+    image: postgres:14-alpine
     secrets:
       - telegram_db_password
     environment:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   web:
-    image: nginx:1.31.1
+    image: nginx:1.31.2
     networks:
       - proxy
       - internal
@@ -43,7 +43,7 @@ services:
       start_period: 2m
 
   app:
-    image: "matrixdotorg/synapse:v1.154.0"
+    image: "matrixdotorg/synapse:v1.155.0"
     volumes:
       - "data:/data"
     secrets:
@@ -114,7 +114,7 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "coop-cloud.${STACK_NAME}.version=7.3.0+v1.154.0"
+        - "coop-cloud.${STACK_NAME}.version=7.2.1+v1.155.0"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8008/health"]