chore: bump Synapse to 1.157.2; bump Ketesa to 1.4.0; 1.156.0:5 → 1.157.2:0

[helix-nine]

Bumps both of this package's upstreams: Synapse 1.156.0 → 1.157.2, and the Ketesa admin dashboard v1.3.0 → v1.4.0. StartOS version 1.156.0:5 → 1.157.2:0.

Synapse 1.157.2

This is a security release — eleven advisories, six of them high severity. Upstream recommends upgrading promptly, particularly for homeservers on open federation or with untrusted local users.

Rolled up from 1.157.0/1.157.1 along the way, the fixes most likely to matter here:

• Application services that opted into ephemeral events via the legacy de.sorunome.msc2409.push_ephemeral flag stopped receiving them — including the to-device messages encryption depends on. A regression introduced in 1.156.0, i.e. the version this package currently ships. Relevant to bridge dependents that register through ensureAppserviceRegistration.
• Reactivating a deactivated-and-erased user did not restore their profile, breaking login, name changes and invitations.
• Repeated deadlocks in Sliding Sync when inserting lazy members.

1.157.0 also removes experimental MSC3861 auth delegation. Not applicable to this package — grepping startos/ for msc3861/experimental_features returns nothing, so the generated homeserver.yaml never enabled it. No migration needed.

Upstream notes: v1.157.0 · v1.157.1 · v1.157.2

Ketesa v1.4.0

• The login screen now honours wellKnownDiscovery: false instead of rewriting the server URL you typed.
• User list filters moved behind a Filter button rather than being welded into the toolbar.
• MAS fixes: admin flag and user_type now resolve correctly.

The rest of the release is etke.cc-hosted billing UI and dependency bumps, neither of which reaches this package. Upstream notes.

Artifact verification

• ghcr.io/element-hq/synapse:v1.157.2 — docker manifest inspect resolves.
• ketesa.tar.gz for v1.4.0 — downloads (HTTP 200), SHA-256 34351c13293e66ed3c024598ce48bbc7b347784b9e618b0ceaf1cb42a7a730b7, recorded in SYNAPSE_ADMIN_CHECKSUM. Tarball layout is unchanged (single ketesa/ top-level dir), so the Makefile's --strip-components=1 still applies.
• Registry's newest published version is 1.156.0:5, so 1.157.2:0 is free.

Other changes

• README.md: the admin dashboard link pointed at etkecc/synapse-admin, the pre-rename repo. Repointed to etkecc/ketesa alongside the pin bump.

No SDK bump — package.json already pins 2.0.9, which is current on npm. No git dependencies in this package, so nothing to re-resolve; package-lock.json is untouched.

Test plan

• npm run check green.
• make builds synapse_x86_64.s9pk (deferred to review per the monitor cycle).