Implement real Matrix notification for coe-mirror

Replace stub notify() with full Synapse integration targeting General room.
- Add _send_matrix(), _get_matrix_token(), _matrix_login() helpers
- Implement token cache with 30-min refresh threshold and 401 retry
- Fetch credentials via Infisical (MATRIX_USER, MATRIX_PASSWORD from matrix/)
- Add MATRIX_* env overrides for testing (homeserver, room, token cache path)
- Non-fatal failures: Matrix outage logs warning, does not break mirror run
- Add 5 comprehensive test cases covering success, failure, 401 refresh, env override, chmod 600
- All 18 tests passing
- Update README and notes.md with implementation details

README.md

@@ -44,7 +44,17 @@ The timer is `Persistent=true` and `OnBootSec=2min`. Missed windows run automati
 
 ## Matrix notification
 
-Currently a stub. Real implementation deferred until the home Matrix server is back. Reference: `~/tools/devtrack/scripts/matrix_alerts.py` shows the auth + send pattern (Infisical creds `MATRIX_USER_ID` and `MATRIX_ACCESS_TOKEN` from the `devtrack` folder, POST to `/_matrix/client/r0/rooms/{room_id}/send/m.room.message`).
+After every run that lands at least one new zip, coe-mirror posts a summary
+to the General room (`!REDACTEDROOM:m.example.org`) on
+`m.example.org`.
+
+- Authentication uses `MATRIX_USER` + `MATRIX_PASSWORD` from Infisical folder
+  `matrix`. Tokens are cached at `~/.local/share/coe-mirror/matrix-token.json`
+  (mode 0600) and auto-refreshed on expiry or 401.
+- Failures are non-fatal: a Matrix outage logs a warning and the rest of the
+  run proceeds normally.
+- Override the target room for testing: `COE_MIRROR_MATRIX_ROOM=! ...:host`.
+- Override the homeserver: `COE_MIRROR_MATRIX_HOMESERVER=https://...`.
 
 ## Testing