feat: deploy matrix authentication service 1.23.0 on :8020

Config at /mnt/docker-data/configs/mas/config.yaml (node-only, holds signing keys).
Health on :8021 (distroless image - no container healthcheck possible).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

compose/hf-pdocker-01/mas/docker-compose.yml

@@ -28,6 +28,40 @@ services:
         max-size: "50m"
         max-file: "3"
 
+  mas:
+    # NOTE: MAS tags are NOT v-prefixed (1.23.0), unlike Synapse (v1.159.0).
+    # Distroless image - no shell, so no container healthcheck is possible.
+    # Liveness is covered by the blackbox probe of https://auth.hobbs.farm/health.
+    image: ghcr.io/element-hq/matrix-authentication-service:1.23.0
+    container_name: mas
+    restart: unless-stopped
+    command: ["server", "--config", "/config/config.yaml"]
+    volumes:
+      - /mnt/docker-data/configs/mas:/config:ro
+      # read-only synapse data dir: syn2mas reads homeserver.yaml from here
+      - /var/lib/synapse:/synapse:ro
+    ports:
+      - "8020:8080"   # web: oauth / compat / discovery / human UI
+      - "8021:8081"   # internal: /health only
+    networks:
+      - mas               # to mas-db
+      - matrix-internal   # to synapse (admin API) and back
+    depends_on:
+      mas-db:
+        condition: service_healthy
+    mem_limit: 256M
+    memswap_limit: 256M
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
 networks:
   mas:
     driver: bridge
+  matrix-internal:
+    external: true
+    name: matrix_matrix-internal