Add mautrix-discord bridge config and installer

Bot-login Discord bridge on LXC 151: config template (DB password is
filled in on the server), systemd unit, and a one-time install script
run from the Proxmox node that sets up the PostgreSQL role/database,
installs the checksum-verified v0.7.7 binary, generates the appservice
registration, adds it to Synapse and restarts Synapse once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

README.md

@@ -26,6 +26,9 @@ matrix/
 │   └── index.html      # matrix.lotusguild.org landing page
 ├── draupnir/
 │   └── production.yaml # Draupnir config (access token is redacted — see rotation docs below)
+├── discord-bridge/
+│   ├── config.yaml     # mautrix-discord config (DB password filled in on the server, never committed)
+│   └── install.sh      # One-time installer, run on the Proxmox node hosting LXC 109 + 151
 ├── deploy/             # Auto-deployment infrastructure
 │   ├── lxc151-hookshot.sh          # Deploy script for LXC 151 (matrix/hookshot/livekit)
 │   ├── lxc106-cinny.sh             # Deploy script for LXC 106 (cinny)
@@ -41,6 +44,7 @@ matrix/
     ├── livekit-graceful-restart.service    # oneshot — checks pending restart flag
     ├── livekit-graceful-restart.timer      # Runs every 5 min
     ├── draupnir.service
+    ├── mautrix-discord.service             # Discord bridge (LXC 151)
     └── cinny-upstream-check.cron           # Installed to /etc/cron.d/ on LXC 106 — runs daily at noon
 ```
 
@@ -286,6 +290,7 @@ The token in `draupnir/production.yaml` in this repo is **intentionally redacted
 | 9002 | Hookshot bridge (appservice) | 127.0.0.1 |
 | 9003 | Hookshot webhooks | 0.0.0.0 |
 | 9004 | Hookshot metrics | 0.0.0.0 |
+| 29334 | mautrix-discord (appservice) | 127.0.0.1 |
 | 9100 | node_exporter | 0.0.0.0 |
 | 9101 | matrix-admin exporter | 0.0.0.0 |
 | 9500 | webhook (auto-deploy) | 0.0.0.0 |
@@ -381,6 +386,45 @@ bash /opt/matrix-config/hookshot/deploy.sh proxmox.js  # deploy one
 
 ---
 
+## Discord Bridge (mautrix-discord v0.7.7)
+
+Bridges Discord channels to Matrix rooms on LXC 151. The bridge logs in as a **Discord bot**
+(not anyone's personal account, which breaks Discord's ToS): Discord users appear in Matrix as
+`@discord_<id>:matrix.lotusguild.org` ghosts, and Matrix users are relayed into Discord through a
+channel webhook with their own display name.
+
+- Bridge bot: `@discordbot:matrix.lotusguild.org`
+- Config: `/opt/mautrix-discord/config.yaml` (template in `discord-bridge/config.yaml`; the bridge
+  rewrites it on start, so it is **not** auto-deployed)
+- Registration: `/etc/matrix-synapse/discord-registration.yaml` (listed in `app_service_config_files`)
+- Database: `mautrix_discord` on LXC 109, role `mautrix_discord`, allowed from 10.10.10.29 in `pg_hba.conf`
+- Service: `systemctl status mautrix-discord`, logs in `journalctl -u mautrix-discord` and `/var/log/mautrix-discord/`
+- End-to-bridge encryption is allowed, so it can join encrypted rooms
+
+**Install (one time):** after this repo's `main` has reached `/opt/matrix-config` on LXC 151, run this
+on the Proxmox node hosting LXC 109 and 151. It restarts Synapse once and is safe to re-run.
+
+```bash
+pct exec 151 -- cat /opt/matrix-config/discord-bridge/install.sh | bash
+```
+
+**Discord side:** Developer Portal → application → Bot. Turn on the **Message Content** and
+**Server Members** intents. Invite the bot with the `bot` scope and View Channels, Send Messages,
+Read Message History, Manage Webhooks, Attach Files, Add Reactions, Manage Messages and Embed Links.
+
+**Linking a room:**
+1. DM `@discordbot:matrix.lotusguild.org`: `login-token bot <bot token>` (the token lives only in the bridge DB)
+2. `guilds bridge <discord server id>` — the server ID comes from Discord Developer Mode → right-click
+3. In the Matrix room: invite `@discordbot`, then `!discord bridge <channel id>` and `!discord set-relay --create`
+
+**Rotating the bot token:** reset it in the Developer Portal, then DM the bridge bot `logout` and
+`login-token bot <new token>`.
+
+**Not set up yet:** `bridge.public_address`, so Matrix users' avatars aren't shown on their relayed
+Discord messages (names are). It needs a public NPM route to `/mautrix-discord/avatar/`.
+
+---
+
 ## Moderation (Draupnir v2.9.0)
 
 Draupnir runs on LXC 110, manages moderation across all protected rooms (including the Lotus Guild space) via `#management:matrix.lotusguild.org`.
@@ -823,6 +867,7 @@ Leaving a space does **not** leave its child rooms; they are independent rooms w
 - [x] Per-service JS transformation functions (stored in git, auto-deployed)
 - [x] Per-service virtual user avatars
 - [x] NPM reverse proxy for `/webhook` path
+- [ ] mautrix-discord bridge (bot login + webhook relay) — config and installer in `discord-bridge/`
 
 ### Room Structure
 - [x] The Lotus Guild space with all core rooms
@@ -1057,6 +1102,7 @@ All commands use the `!` prefix. Run `!help` in any room for the full list.
 | Moderation | Draupnir | 2.9.0 |
 | SSO | Authelia (OIDC) + LLDAP | — |
 | Webhook bridge | matrix-hookshot | 7.3.2 |
+| Discord bridge | mautrix-discord | 0.7.7 |
 | Reverse proxy | Nginx Proxy Manager | — |
 | Web client | Lotus Cinny (fork of `cinnyapp/cinny` main) | custom |
 | Element Call embed | `@lotusguild/element-call-embedded` (self-built fork of `element-hq/element-call`) | 0.20.1-lotus.1 |