chore(dev): dev homeserver serves URL previews (embed facade thumbnails) and installs the url-preview extra

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

scripts/dev-homeserver.sh

@@ -23,7 +23,7 @@ install() {
     python3 -m venv --without-pip "$VENV"
     curl -sS https://bootstrap.pypa.io/get-pip.py -o "$DIR/get-pip.py"
     "$VENV/bin/python" "$DIR/get-pip.py" -q
-    "$VENV/bin/pip" install -q matrix-synapse
+    "$VENV/bin/pip" install -q "matrix-synapse[url-preview]"
   fi
   if [ ! -f "$CFG" ]; then
     (cd "$DIR" && "$VENV/bin/python" -m synapse.app.homeserver \
@@ -43,6 +43,9 @@ rc_joins: { local: { per_second: 1000, burst_count: 10000 }, remote: { per_secon
 rc_presence: { per_user: { per_second: 1000, burst_count: 10000 } }
 max_upload_size: 50M
 suppress_key_server_warning: true
+# URL previews (embed facades use the homeserver's cached thumbnail)
+url_preview_enabled: true
+url_preview_ip_range_blacklist: ['127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', '100.64.0.0/10', '169.254.0.0/16', '::1/128', 'fe80::/10', 'fc00::/7']
 # scheduled messages (MSC4140 delayed events)
 max_event_delay_duration: 24h
 experimental_features: