Add Matrix intake bot (M1+M2): typed message → approved fundraising-grid write

New backend/matrix_intake/ runs as its own process (matrix-nio isolated from the
stdlib CRM): local-Qwen parse via Spark Control → in-thread human approval
(yes/edit/no) → write through the CRM's own log-communication endpoint, tagged
source=matrix_intake. Adds read-only GET /api/intake/match (returns grid row id,
no-duplicate contract); threads provenance through handle_log_fundraising_communication.
Reviewer-passed: pop-before-commit closes a double-approve race; edit-grammar fix.
Text-only v1; business-card photo (M3) deferred (no Spark vision model).
26/26 tests green; live Matrix smoke pending deploy.

.env.example

@@ -47,3 +47,20 @@ SMTP_SECURITY=starttls
 SMTP_FROM=
 SMTP_USERNAME=
 SMTP_PASSWORD=
+
+# ── Matrix intake bot (backend/matrix_intake/, runs as its own process on the Spark) ──
+# Parses a typed message in a dedicated Matrix room into a proposed fundraising-grid
+# add/edit (local Qwen via Spark Control above), then writes through the CRM API only
+# after in-thread human approval. Reuses SPARK_CONTROL_URL / CRM_CHAT_MODEL above.
+MATRIX_HOMESERVER=https://<homeserver>
+MATRIX_USER=@intake-bot:<homeserver>
+MATRIX_ACCESS_TOKEN=
+MATRIX_DEVICE_ID=ten31-intake-bot
+MATRIX_INTAKE_ROOM=!<roomid>:<homeserver>
+# CRM write-back: the bot logs in as a DEDICATED service user (admin-created CRM user;
+# the CRM has no service-key path, so it uses normal Bearer-JWT auth).
+CRM_API_BASE=http://127.0.0.1:8080
+CRM_BOT_USERNAME=
+CRM_BOT_PASSWORD=
+# Set to false only if CRM_API_BASE is https with a self-signed cert.
+CRM_API_VERIFY_TLS=true