Upgrade mautrix-telegram (v0.15.3 -> v0.2604.0) (bridgev2) and adapt configuration

Matches the earlier Python -> Go rewrites of the other mautrix-* bridges.

Related to:
- https://github.com/mautrix/telegram/releases/tag/v0.2604.0
- https://mau.fi/blog/2026-04-mautrix-release/

The bridge is now a Go binary with upstream-handled automatic database and
config migration on first start, so in-place upgrades on Postgres should
Just Work for users on the defaults. The lottieconverter sidecar container
is gone (bundled upstream), and the public web-based login endpoint is
gone (login happens inside Matrix now).

Upstream v0.2604.0 has a known bug in the legacy SQLite migration that
can corrupt data. The role detects legacy Python-bridge SQLite databases
(via the `telethon_sessions` table signature) and refuses to upgrade,
pointing users to switch to Postgres (playbook-managed pgloader migration)
or wait for the next upstream release. The guard is isolated in its own
`validate_config_sqlite_legacy_migration_bug.yml` so it can be deleted
cleanly once upstream fixes the bug.

Removed variables (all caught by the deprecation check in
`validate_config.yml` with actionable rename/removal hints): the entire
`_hostname` / `_path_prefix` / `_scheme` / `_public_endpoint` /
`_appservice_public_*` / `_container_labels_public_endpoint_*` /
`_container_http_host_bind_port` family (web login endpoint is gone);
`_bot_token` (old-style relaybot is gone, use the common bridgev2 relay
mode); `_filter_mode` (dropped upstream); `_bridge_login_shared_secret_map*`
(use Appservice Double Puppet); `_username_template`, `_alias_template`,
`_displayname_template` (templates moved under `network:`, new Go-template
syntax, exposed via `_network_displayname_template`); all
`_lottieconverter_*` variables; `_appservice_database` (renamed to
`_appservice_database_uri`).

Added playbook-time validation that catches legacy permission values
(`relaybot`, `puppeting`, `full`) in the fully-merged config (so overrides
via `matrix_mautrix_telegram_configuration_extension_yaml` are caught too),
with a mapping hint in the error message.

Other notes:

- The legacy sqlite->postgres relocation of `{base_path}/mautrix-telegram.db`
  to `{data_path}/mautrix-telegram.db` now happens BEFORE the pgloader
  migration step, so users who flip to Postgres as part of this upgrade
  get their data imported correctly.
- The Ketesa managed-user regex for the telegram namespace is updated to
  match both regular IDs and the new `channel-<id>` form used by bridgev2.
- `matrix_playbook_migration_expected_version` bumped to v2026.04.24.0,
  with a new breaking-change entry pointing at the CHANGELOG section.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2018 - 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2018 - 2026 Slavi Pantaleev
 # SPDX-FileCopyrightText: 2018 Hugues Morisset
 # SPDX-FileCopyrightText: 2019 Aaron Raimist
 # SPDX-FileCopyrightText: 2019 Dan Arnfield
@@ -20,6 +20,40 @@
 - ansible.builtin.set_fact:
     matrix_mautrix_telegram_migration_requires_restart: false
 
+# The legacy Python bridge stored its SQLite DB at `{base_path}/mautrix-telegram.db` (the role's
+# root). Later, we started relocating it to `{base_path}/data/mautrix-telegram.db`. The sqlite→
+# postgres migration below only knows about the new path, so if the DB is still at the legacy
+# location, move it to the new location first — otherwise users who follow the changelog and
+# switch to Postgres wouldn't actually get their data imported before the service starts.
+- name: Check if a legacy-location SQLite database exists
+  ansible.builtin.stat:
+    path: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
+  register: matrix_mautrix_telegram_stat_database_legacy_location
+
+- when: matrix_mautrix_telegram_stat_database_legacy_location.stat.exists | bool
+  block:
+    - name: Ensure matrix-mautrix-telegram.service is stopped before relocating legacy SQLite DB
+      ansible.builtin.service:
+        name: matrix-mautrix-telegram
+        state: stopped
+        enabled: false
+        daemon_reload: true
+      failed_when: false
+
+    - name: Ensure data directory exists for legacy SQLite DB relocation
+      ansible.builtin.file:
+        path: "{{ matrix_mautrix_telegram_data_path }}"
+        state: directory
+        mode: '0750'
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+
+    - name: (Data relocation) Move mautrix-telegram SQLite DB from legacy location to data directory
+      ansible.builtin.command:
+        cmd: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+        creates: "{{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+        removes: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
+
 - when: "matrix_mautrix_telegram_database_engine == 'postgres'"
   block:
     - name: Check if an SQLite database already exists
@@ -40,6 +74,7 @@
               engine_variable_name: 'matrix_mautrix_telegram_database_engine'
               engine_old: 'sqlite'
               systemd_services_to_stop: ['matrix-mautrix-telegram.service']
+              pgloader_options: ['--with "quote identifiers"']
 
         - ansible.builtin.set_fact:
             matrix_mautrix_telegram_migration_requires_restart: true
@@ -70,41 +105,18 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_mautrix_telegram_container_image_pull_result is not failed
 
-- name: Ensure lottieconverter is present when self-building
+- name: Ensure Mautrix Telegram repository is present on self-build
   ansible.builtin.git:
-    repo: "{{ matrix_mautrix_telegram_lottieconverter_container_repo }}"
-    version: "{{ matrix_mautrix_telegram_lottieconverter_container_repo_version }}"
-    dest: "{{ matrix_mautrix_telegram_lottieconverter_container_src_files_path }}"
-    force: "yes"
-  become: true
-  become_user: "{{ matrix_user_name }}"
-  register: matrix_mautrix_telegram_lottieconverter_git_pull_results
-  when: "matrix_mautrix_telegram_lottieconverter_container_image_self_build | bool and matrix_mautrix_telegram_container_image_self_build | bool"
-
-- name: Ensure lottieconverter Docker image is built
-  community.docker.docker_image:
-    name: "{{ matrix_mautrix_telegram_lottieconverter_container_image }}"
-    source: build
-    force_source: "{{ matrix_mautrix_telegram_lottieconverter_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_telegram_lottieconverter_git_pull_results.changed }}"
-    build:
-      dockerfile: Dockerfile
-      path: "{{ matrix_mautrix_telegram_lottieconverter_container_src_files_path }}"
-      pull: true
-  when: "matrix_mautrix_telegram_lottieconverter_container_image_self_build | bool and matrix_mautrix_telegram_lottieconverter_git_pull_results.changed and matrix_mautrix_telegram_container_image_self_build | bool"
-
-- name: Ensure matrix-mautrix-telegram repository is present when self-building
-  ansible.builtin.git:
-    repo: "{{ matrix_mautrix_telegram_container_repo }}"
-    version: "{{ matrix_mautrix_telegram_container_repo_version }}"
+    repo: "{{ matrix_mautrix_telegram_container_image_self_build_repo }}"
     dest: "{{ matrix_mautrix_telegram_container_src_files_path }}"
+    version: "{{ matrix_mautrix_telegram_container_image_self_build_branch }}"
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
   register: matrix_mautrix_telegram_git_pull_results
   when: "matrix_mautrix_telegram_container_image_self_build | bool"
 
-- name: Ensure matrix-mautrix-telegram Docker image is built
+- name: Ensure Mautrix Telegram Docker image is built
   community.docker.docker_image:
     name: "{{ matrix_mautrix_telegram_container_image }}"
     source: build
@@ -113,31 +125,8 @@
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mautrix_telegram_container_src_files_path }}"
-      pull: "{{ not matrix_mautrix_telegram_lottieconverter_container_image_self_build_mask_arch | bool }}"
-      args:
-        TARGETARCH: ""
-  when: "matrix_mautrix_telegram_container_image_self_build | bool and matrix_mautrix_telegram_git_pull_results.changed"
-
-- name: Check if an old database file already exists
-  ansible.builtin.stat:
-    path: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
-  register: matrix_mautrix_telegram_stat_database
-
-- name: (Data relocation) Ensure matrix-mautrix-telegram.service is stopped
-  ansible.builtin.service:
-    name: matrix-mautrix-telegram
-    state: stopped
-    enabled: false
-    daemon_reload: true
-  failed_when: false
-  when: "matrix_mautrix_telegram_stat_database.stat.exists"
-
-- name: (Data relocation) Move mautrix-telegram database file to ./data directory
-  ansible.builtin.command:
-    cmd: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
-    creates: "{{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
-    removes: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
-  when: "matrix_mautrix_telegram_stat_database.stat.exists"
+      pull: true
+  when: "matrix_mautrix_telegram_container_image_self_build | bool"
 
 - name: Ensure mautrix-telegram config.yaml installed
   ansible.builtin.copy: