Voice and video calls: TURN endpoint and web client calls

Server: GET /voip/turnServer, configured under client_api.turn. A shared
secret (coturn use-auth-secret) gives each user expiring TURN REST API
credentials; static credentials are the fallback; with nothing configured
it answers {} so clients still try a direct connection.

Web client: 1:1 calls (Matrix VoIP via matrix-js-sdk) in rooms with one
other person. Voice and video buttons in the room header, a ringing card
with answer, answer without video and decline, and a call panel that
stays up across rooms: mute, camera, screen sharing, expand, hang up,
ring tones. Call events show in the timeline and room list. Works around
the SDK keeping a failed microphone request forever.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/setup/server.go

@@ -489,6 +489,7 @@ func New(ctx context.Context, cfg *config.Config, opts Options) (*Server, error)
 		RegistrationTokens:   s.regTokens,
 		AppServices:          s.appservices,
 		RateLimit:            cfg.ClientAPI.RateLimit,
+		TURN:                 cfg.ClientAPI.TURN,
 		TrustXForwardedFor:   cfg.ClientAPI.TrustXForwardedFor,
 		Logger:               log,
 	})