matrix-tuwunel: add matrix_tuwunel_config_msc3664_related_event_match

Tuwunel v1.9.0 adds the default `.im.nheko.msc3664.reply` push rule to every
account, but only evaluates its condition when this option is on. Without it,
replies do not affect notification counts or reach pushers.

Kept off, as upstream has it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/custom/matrix-tuwunel/defaults/main.yml

@@ -265,6 +265,12 @@ matrix_tuwunel_config_enable_policy_servers: false
 # signature-fetches against a room's policy server.
 matrix_tuwunel_config_policy_server_request_timeout: 5
 
+# Whether tuwunel evaluates MSC3664 related-event push conditions itself.
+# The default `.im.nheko.msc3664.reply` rule needs this to affect notification counts and pusher delivery.
+# Clients implementing MSC3664 evaluate the rule locally either way.
+# Enabling it costs an extra event lookup for every event carrying a relation.
+matrix_tuwunel_config_msc3664_related_event_match: false
+
 # Outgoing presence is heavy on CPU and network and almost no clients use it. Off by default.
 matrix_tuwunel_config_allow_outgoing_presence: false
 

roles/custom/matrix-tuwunel/templates/tuwunel.toml.j2

@@ -61,6 +61,8 @@ ip_range_denylist = {{ matrix_tuwunel_config_ip_range_denylist | to_json }}
 enable_policy_servers = {{ matrix_tuwunel_config_enable_policy_servers | to_json }}
 policy_server_request_timeout = {{ matrix_tuwunel_config_policy_server_request_timeout }}
 
+msc3664_related_event_match = {{ matrix_tuwunel_config_msc3664_related_event_match | to_json }}
+
 allow_outgoing_presence = {{ matrix_tuwunel_config_allow_outgoing_presence | to_json }}
 
 {% if matrix_tuwunel_config_url_preview_domain_contains_allowlist | length > 0 %}