Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/README.md

@@ -63,12 +63,24 @@ that one origin.
   them asks you to acknowledge it; a reset since you *verified* them says
   their sessions are no longer trusted, with Verify again or Withdraw
   verification.
-- Voice and video calls in a room with one other person (Matrix 1:1 VoIP,
-  WebRTC between the browsers): ringing, answer with or without video,
-  mute, camera on and off, screen sharing, and a panel that stays up while
-  you move between rooms and expands to fill the window. In an encrypted
-  room the call signalling is encrypted too. Calls outside one network
-  need a TURN server; see `client_api.turn` in the server configuration.
+- Voice and video calls in any room, all through a LiveKit SFU (MatrixRTC,
+  the Element Call model; the old Matrix 1:1 VoIP is not used). Voice and
+  video call buttons in the room header. In a room with one other person
+  the call rings them: an incoming-call card with ring tone, answer, answer
+  without video and decline, and "Calling…" with a ringback tone for the
+  caller until they answer, decline or a minute passes. A call of two shows
+  the other person large and you in the corner; a bigger one is a grid
+  with a tile per person, their camera or screen, and a ring around
+  whoever is speaking. Mute, camera, screen sharing, leave, and a panel
+  that stays up while you move between rooms. A "Join call" banner while
+  one is going on in a room you're not in it. In an encrypted room the media
+  is end-to-end encrypted with per-participant keys. The room list says
+  when a room has a call going on, and the timeline says when one started
+  and ended. It needs `client_api.rtc` on the server and a LiveKit JWT
+  service; see [docs/calls.md](../../docs/calls.md). warp-web proxies
+  `/.well-known/matrix/client` for this, and `-call-origins`
+  (`WARP_WEB_CALL_ORIGINS`) lets the browser reach the JWT service and
+  LiveKit through the Content-Security-Policy.
 - Encryption setup in Settings: cross-signing keys, secret storage and a
   key backup in one step, behind a recovery key shown once. A new session
   verifies itself with the recovery key (or another session) and restores