feat(#551): enable matrix e2ee -- add e2e-encryption feature, wire EncryptionSettings, flip tuwunel allow_encryption

hive-matrix-mcp/src/client.rs

@@ -9,6 +9,13 @@
 //! UIAA flow already minted the token + user/device, hive-c0re just
 //! handed us the bearer in a file. matrix-sdk's `restore_session` with
 //! a constructed `MatrixSession` skips the login flow entirely.
+//!
+//! E2EE is enabled via `with_encryption_settings(EncryptionSettings::default())`.
+//! Crypto keys are persisted in the sqlite store under `state_dir`
+//! (survives container restarts, lost on `--purge`). Cross-signing and
+//! automatic key backup are deliberately left at their defaults (disabled)
+//! for the first pass: bot accounts authenticated with a static bearer token
+//! can't bootstrap cross-signing without MSC3967 on the server side.
 
 use std::path::Path;
 
@@ -16,6 +23,7 @@ use anyhow::{Context, Result, anyhow};
 use matrix_sdk::{
     Client, SessionMeta, SessionTokens,
     authentication::matrix::MatrixSession,
+    encryption::EncryptionSettings,
     ruma::{OwnedDeviceId, OwnedUserId},
 };
 use serde::Deserialize;
@@ -108,6 +116,7 @@ pub async fn build_and_restore(
     let client = Client::builder()
         .homeserver_url(homeserver)
         .sqlite_store(state_dir, None)
+        .with_encryption_settings(EncryptionSettings::default())
         .build()
         .await
         .with_context(|| format!("build matrix client for {homeserver}"))?;