Switch chat CT to tuwunel 1.9.4 with R2 media provider

infra/occupymedia/docker-compose.chat.yml

@@ -1,26 +1,19 @@
 # occupymedia.cc — CHAT CT (occ-chat, CT 152, tailscale 100.117.210.52)
-# Matrix plane: conduwuit (+ optional Telegram bridge, one-time interactive login).
+# Matrix plane: tuwunel v1.9.4 (config: /opt/occupymedia/tuwunel.toml, secret: R2 creds in that file,
+# registration token inline). Rollback: docker-compose.chat.yml.pre-tuwunel + the
+# conduwuit_data volume (never deleted) + snapshots in /opt/backups.
 
 name: occ-chat
 
 services:
   conduwuit:
-    image: girlbossceo/conduwuit:latest
-    environment:
-      CONDUWUIT_SERVER_NAME: chat.occupymedia.cc
-      CONDUWUIT_ADDRESS: 0.0.0.0
-      CONDUWUIT_PORT: "6167"
-      CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
-      CONDUWUIT_DATABASE_BACKEND: rocksdb
-      CONDUWUIT_MAX_REQUEST_SIZE: "20000000"
-      CONDUWUIT_ALLOW_REGISTRATION: "true"
-      CONDUWUIT_REGISTRATION_TOKEN: "${MATRIX_REGISTRATION_TOKEN:?}"
-      CONDUWUIT_ALLOW_FEDERATION: "true"
-      CONDUWUIT_ALLOW_ROOM_CREATION: "true"
+    image: tuwunel:v1.9.4
+    command: ["-c", "/etc/tuwunel/tuwunel.toml"]
     volumes:
-      - conduwuit_data:/var/lib/conduwuit
+      - tuwunel_data:/var/lib/conduwuit
+      - /opt/occupymedia/tuwunel.toml:/etc/tuwunel/tuwunel.toml:ro
     ports:
-      - "6167:6167"   # tunnel: chat.occupymedia.cc → 100.117.210.52:6167
+      - "6167:6167"   # tunnel: chat.occupymedia.cc -> 100.117.210.52:6167
     restart: unless-stopped
 
   # First run is interactive: docker compose run --rm mautrix-telegram
@@ -32,5 +25,6 @@ services:
     restart: unless-stopped
 
 volumes:
-  conduwuit_data:
+  tuwunel_data:
+  conduwuit_data:  # pre-tuwunel rollback source
   mautrix_telegram_data: