Phase 2: the event core

Implements PLAN.md Phase 2: the library every later phase is built on,
as pure code under server/internal/matrix with no HTTP and no storage.

canonicaljson: the canonical JSON encoding, hand-written because
encoding/json escapes <, > and & and accepts floats. Integers only, in
[-(2^53)+1, 2^53-1]; lone surrogate escapes rejected rather than turned
into U+FFFD.

signing: the Signing JSON algorithm alongside the existing key handling,
and one lenient base64 decoder shared by the packages above it.

id: identifier grammars as they appear inside events, deliberately laxer
than userapi's account rules because rooms carry historical user IDs.

roomversion: the registry. Versions 3 to 12 are supported, each written
out in full as a Rules value with the flags the other packages read.
Versions 1 and 2 are known but refused: their event format and state
resolution v1 wait for federation. createRoom will default to 11, as the
spec asks for a while after 1.16, with 12 available.

event: PDU parsing and validation, content and reference hashes, event
IDs, the redaction algorithm for every supported version, signing and
verification, and a Builder.

auth: the authorisation rules in spec order, power levels with their
defaults, v12 creators with infinite power, the auth events selection
algorithm, rule 3's auth_events checks, and the separate test for
whether a redaction applies. Comments use the room version 12 rule
numbering, with the version 11 numbers given where they differ.

stateres: state resolution v2, and version 12's amendment (an empty
starting state and the conflicted state subgraph).

Tested against the spec's own vectors byte for byte: the canonical JSON
examples, both JSON signing vectors and both event signing vectors.
State resolution ports scenarios from Synapse's suite. canonicaljson
and event.Parse have fuzz targets.

The capabilities endpoint now advertises the registry instead of a
hard-coded "11". docs/event-core.md describes the packages and the
known gaps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -9,6 +9,14 @@ what exists today.
 
 ## Status
 
+**Phase 2 — the event core. Complete.** The library that every later phase
+is built on: canonical JSON, the event model with its hashes and
+identifiers, the redaction algorithm, event signing, the room version
+registry, the authorisation rules and state resolution v2. It is pure
+library code under `server/internal/matrix`, verified against the spec's
+own test vectors, and nothing serves it over HTTP yet — rooms are Phase 3.
+See [docs/event-core.md](docs/event-core.md).
+
 **Phase 1 — accounts and sessions. Complete.** A client can register, log
 in, manage its devices and set its profile. There are no rooms and no real
 `/sync` yet: those are Phases 3 and 4.
@@ -156,7 +164,14 @@ server/                 the homeserver (Go module)
     clientapi/          the Client-Server API handlers
     adminapi/           /_warp/admin/v1
     setup/              wiring: storage, routes, graceful shutdown
-    matrix/signing/     ed25519 server keys
+    matrix/             the event core (docs/event-core.md)
+      canonicaljson/    the canonical JSON encoding
+      signing/          ed25519 server keys, Signing JSON
+      id/               identifier grammars as they appear in events
+      roomversion/      the room version registry
+      event/            PDUs: hashes, event IDs, redaction, signing
+      auth/             the authorisation rules and power levels
+      stateres/         state resolution v2
     storage/            interfaces + driver registry
       migrations/       embedded migration runner
       sqlstore/         shared database/sql implementation