keyserver: cache remote users' device and cross-signing keys

POST /keys/query for a remote user who shares a room with a local user is
now answered from a cache, fetched whole with GET /user/devices/{userId}
on a miss. Incoming m.device_list_update EDUs are applied when their
prev_id matches the cached stream_id; anything else marks the copy stale
and it is fetched again in the background, and a stale copy is never
served. m.signing_key_update replaces the cached cross-signing keys. A
user's copy is dropped once no local user shares a room with them, by a
keyserver listener on the roomserver's emit stage.

Migration 0009 adds keyserver_remote_users, keyserver_remote_device_keys
and keyserver_remote_cross_signing_keys for sqlite and postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/setup/server.go

@@ -295,6 +295,7 @@ func New(ctx context.Context, cfg *config.Config, opts Options) (*Server, error)
 			return nil, err
 		}
 		s.users.SetDeviceObserver(s.keys)
+		emit.add(keyMemberships{keys: s.keys})
 
 		s.sync, err = syncapi.New(syncapi.Options{
 			ServerName:      cfg.Global.ServerName,
@@ -576,6 +577,11 @@ func (s *Server) Close() error {
 	if s.fedModule != nil {
 		s.fedModule.Stop()
 	}
+	if s.keys != nil {
+		// Background fetches of remote keys write to the database, which
+		// is about to close.
+		s.keys.Close()
+	}
 	if s.sync != nil {
 		// The typing tracker holds a timer per typing user; a server
 		// shutting down should not wait for them.