feat(chat): join users to rooms on sign-in

infrastructure/matrix/synapse/homeserver.yaml.tmpl

@@ -42,6 +42,24 @@ federation_domain_whitelist: []
 enable_registration: false
 encryption_enabled_by_default_for_room_type: "off"
 
+# Turning rooms' encryption off above is not enough on its own: Element still
+# bootstraps cross-signing on a user's first login, and from then on gates
+# EVERY later login behind "Verify this device" (MatrixChat: crossSigningIsSetUp
+# -> Views.COMPLETE_SECURITY). Nobody on this deployment can clear that gate —
+# each SSO click is a brand-new device, so there is never a second verified
+# device to accept the request, and resetting the identity needs UIA, which
+# password_config.enabled: false makes impossible.
+#
+# This tells Element encryption is off here, so it skips the bootstrap
+# (shouldSkipSetupEncryption) and the gate is never armed. Only helps accounts
+# that have no cross-signing keys yet — anyone already bootstrapped keeps
+# hitting the gate until their keys are cleared.
+extra_well_known_client_content:
+  io.element.e2ee:
+    default: false
+    force_disable: true
+    secure_backup_required: false
+
 # Employees authenticate via freight-api's SSO handoff, never a Matrix
 # password prompt. This is the entire auth story for this deployment.
 password_config: