mautrix-slack: expose bridge HTTP API (for mautrix-manager and similar)

Unlike the other mautrix bridges, the mautrix-slack role had no Traefik
label infrastructure at all, so this builds the scaffold first (a new
labels.j2, the container_labels_traefik_* vars, the label-file wiring in
the systemd service and setup_install.yml, and the group_vars wiring),
then exposes the bridge's appservice HTTP API under
https://matrix.<domain>/bridges/slack like the other bridges.

The provisioning shared secret was already auto-generated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml

@@ -97,6 +97,17 @@
     group: "{{ matrix_group_name }}"
   register: matrix_mautrix_slack_registration_result
 
+- name: Ensure mautrix-slack support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_slack_base_path }}/{{ item }}"
+    mode: '0640'
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - labels
+  register: matrix_mautrix_slack_support_files_result
+
 - name: Ensure matrix-mautrix-slack container network is created
   when: matrix_mautrix_slack_container_network != 'host'
   community.general.docker_network:
@@ -119,6 +130,7 @@
         matrix_mautrix_slack_migration_requires_restart | default(false)
         or matrix_mautrix_slack_config_result.changed | default(false)
         or matrix_mautrix_slack_registration_result.changed | default(false)
+        or matrix_mautrix_slack_support_files_result.changed | default(false)
         or matrix_mautrix_slack_systemd_service_result.changed | default(false)
         or matrix_mautrix_slack_container_image_pull_result.changed | default(false)
         or matrix_mautrix_slack_container_image_build_result.changed | default(false)