Fix the sqlite database URI for the mautrix-meta bridges

Both roles derived `..._appservice_database_uri` as `'sqlite:///' + <path>`.
mautrix-go hands that string to go-sqlite3 as a filename rather than parsing it
as a URL, so the bridge cannot open its database and dies at startup:

  FTL Failed to initialize database
      error="... unable to open database file: no such file or directory"

Every other mautrix bridge role here passes the bare in-container path.

This has stayed hidden because group_vars/matrix_servers selects postgres
whenever postgres is enabled, which is the default - so almost nobody reaches
the sqlite branch. Anyone who does gets a bridge that never starts.

Found by the mautrix-meta-messenger Molecule scenario, which runs sqlite
deliberately. The scenario's override is dropped and its assertion now compares
the rendered URI against the path the role defines, so the derived value is
what is under test rather than the scenario's own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT

roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml

@@ -139,7 +139,7 @@ matrix_bridge_mautrix_meta_instagram_appservice_database_type: "{{ matrix_bridge
 matrix_bridge_mautrix_meta_instagram_appservice_database_uri: |-
   {{
     {
-      'sqlite3-fk-wal': ('sqlite:///' + matrix_bridge_mautrix_meta_instagram_sqlite_database_path_in_container),
+      'sqlite3-fk-wal': matrix_bridge_mautrix_meta_instagram_sqlite_database_path_in_container,
       'postgres': matrix_bridge_mautrix_meta_instagram_database_connection_string,
     }[matrix_bridge_mautrix_meta_instagram_database_engine]
   }}

roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml

@@ -148,7 +148,7 @@ matrix_bridge_mautrix_meta_messenger_appservice_database_type: "{{ matrix_bridge
 matrix_bridge_mautrix_meta_messenger_appservice_database_uri: |-
   {{
     {
-      'sqlite3-fk-wal': ('sqlite:///' + matrix_bridge_mautrix_meta_messenger_sqlite_database_path_in_container),
+      'sqlite3-fk-wal': matrix_bridge_mautrix_meta_messenger_sqlite_database_path_in_container,
       'postgres': matrix_bridge_mautrix_meta_messenger_database_connection_string,
     }[matrix_bridge_mautrix_meta_messenger_database_engine]
   }}

roles/custom/matrix-bridge-mautrix-meta-messenger/molecule/default/molecule.yml

@@ -40,19 +40,12 @@ provisioner:
         # database engine the bridge can talk to is not what this proves.
         matrix_bridge_mautrix_meta_messenger_database_engine: sqlite3-fk-wal
 
-        # The URI is overridden because the one the role derives for
-        # `sqlite3-fk-wal` does not work: it builds `sqlite:///` + the
-        # in-container path, and the bridge hands that to go-sqlite3 as a plain
-        # filename rather than parsing it as a URL, so it dies at startup with
-        # `unable to open database file: no such file or directory`. The value
-        # below is the shape the other mautrix roles here use (a bare path;
-        # compare matrix-bridge-mautrix-signal, which adds the same _txlock the
-        # bridge warns about when it is missing).
-        #
-        # The playbook picks postgres whenever postgres is enabled, which is the
-        # default, so nothing normally reaches this code path. Left as an
-        # override rather than a fix: that is a consumer-visible default.
-        matrix_bridge_mautrix_meta_messenger_appservice_database_uri: "/data/mautrix-meta.db?_txlock=immediate"
+        # The URI the role derives for `sqlite3-fk-wal` is deliberately NOT
+        # overridden here. It used to build `sqlite:///` + the in-container path,
+        # which go-sqlite3 takes as a plain filename rather than parsing as a URL,
+        # so the bridge died at startup with `unable to open database file`. This
+        # scenario is what caught it. Leaving the role's own value in place is
+        # what keeps it caught.
 
         # Appservice tokens. These are what the bridge and homeserver would
         # authenticate to each other with; here they only have to reach the

roles/custom/matrix-bridge-mautrix-meta-messenger/molecule/default/verify.yml

@@ -149,18 +149,18 @@
           matrix_bridge_mautrix_meta_messenger_meta_mode=facebook-tor
         success_msg: "The rendered configuration reflects the Meta mode the scenario selected"
 
-    # sqlite3-fk-wal was chosen in molecule.yml. The URI is a scenario override
-    # rather than the role's derived value - see the comment in molecule.yml -
-    # so what this checks is only that both reach the configuration. The real
-    # proof that the bridge is using the role's data path is the database file
-    # asserted further down.
-    - name: Assert the configuration points the bridge at the sqlite database the scenario chose
+    # The URI must stay a bare path. go-sqlite3 takes it as a filename, so a
+    # `sqlite:///` prefix makes the bridge die at startup - which is what this
+    # role's default used to do.
+    - name: Assert the configuration points the bridge at the sqlite database the role derived
       ansible.builtin.assert:
         that:
           - mautrix_meta_messenger_config.database.type == matrix_bridge_mautrix_meta_messenger_database_engine
-          - mautrix_meta_messenger_config.database.uri == matrix_bridge_mautrix_meta_messenger_appservice_database_uri
-        fail_msg: "The rendered configuration does not point the bridge at the scenario's sqlite database"
-        success_msg: "The rendered configuration points the bridge at the scenario's sqlite database"
+          - mautrix_meta_messenger_config.database.uri == mautrix_meta_messenger_role_defaults.matrix_bridge_mautrix_meta_messenger_sqlite_database_path_in_container
+        fail_msg: >-
+          database.uri is {{ mautrix_meta_messenger_config.database.uri | default('unset') }},
+          which is not the bare in-container path the role defines
+        success_msg: "The rendered configuration points the bridge at the sqlite database the role derived"
 
     # The public address is what the role builds out of the three exposure
     # variables; it is the same endpoint the Traefik labels below route to.