chore(deps): update dependency element-hq/synapse to v1.149.0 (#4580)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [element-hq/synapse](https://github.com/element-hq/synapse) | minor | `v1.148.0` → `v1.149.0` |

---

### Release Notes

<details>
<summary>element-hq/synapse (element-hq/synapse)</summary>

### [`v1.149.0`](https://github.com/element-hq/synapse/releases/tag/v1.149.0)

[Compare Source](element-hq/synapse@v1.148.0...v1.149.0)

### Synapse 1.149.0 (2026-03-10)

No significant changes since 1.149.0rc1.

### Synapse 1.149.0rc1 (2026-03-03)

#### Features

- Add experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](matrix-org/matrix-spec-proposals#4388). ([#&#8203;19127](element-hq/synapse#19127))
- Add stable support for [MSC4380](matrix-org/matrix-spec-proposals#4380) invite blocking. ([#&#8203;19431](element-hq/synapse#19431))

#### Bugfixes

- Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token. ([#&#8203;18518](element-hq/synapse#18518))
- Fix `/sync` missing membership event in `state_after` (experimental [MSC4222](matrix-org/matrix-spec-proposals#4222) implementation) in some scenarios. ([#&#8203;19460](element-hq/synapse#19460))

#### Internal Changes

- Add log to explain when and why we freeze objects in the garbage collector. ([#&#8203;19440](element-hq/synapse#19440))
- Better instrument `JoinRoomAliasServlet` with tracing. ([#&#8203;19461](element-hq/synapse#19461))
- Fix Complement CI not running against the code from our PRs. ([#&#8203;19475](element-hq/synapse#19475))
- Log `docker system info` in CI so we have a plain record of how GitHub runners evolve over time. ([#&#8203;19480](element-hq/synapse#19480))
- Rename the `test_disconnect` test helper so that pytest doesn't see it as a test. ([#&#8203;19486](element-hq/synapse#19486))
- Add a log line when we delete devices. Contributed by [@&#8203;bradtgmurray](https://github.com/bradtgmurray) @&#8203; Beeper. ([#&#8203;19496](element-hq/synapse#19496))
- Pre-allocate the buffer based on the expected `Content-Length` with the Rust HTTP client. ([#&#8203;19498](element-hq/synapse#19498))
- Cancel long-running sync requests if the client has gone away. ([#&#8203;19499](element-hq/synapse#19499))
- Try and reduce reactor tick times when under heavy load. ([#&#8203;19507](element-hq/synapse#19507))
- Simplify Rust HTTP client response streaming and limiting. ([#&#8203;19510](element-hq/synapse#19510))
- Replace deprecated collection import locations with current locations. ([#&#8203;19515](element-hq/synapse#19515))
- Bump most locked Python dependencies to their latest versions. ([#&#8203;19519](element-hq/synapse#19519))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4580
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

Author: Renovate Bot

clusters/cl01tl/helm/matrix-synapse/Chart.yaml

@@ -81,4 +81,4 @@ dependencies:
     repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/matrix.png
 # renovate: datasource=github-releases depName=element-hq/synapse
-appVersion: v1.148.0
+appVersion: v1.149.0