Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/cmd/warp-web/main.go

@@ -54,6 +54,8 @@ func run() error {
 		"base URL of the homeserver, proxied for the client (WARP_WEB_HOMESERVER)")
 	public := flag.String("public-homeserver", env("WARP_WEB_PUBLIC_HOMESERVER", ""),
 		"public URL of the homeserver; when set, the browser calls it directly and nothing is proxied (WARP_WEB_PUBLIC_HOMESERVER)")
+	callOrigins := flag.String("call-origins", env("WARP_WEB_CALL_ORIGINS", ""),
+		"space-separated origins of the LiveKit JWT service and SFU the browser may connect to for group calls (WARP_WEB_CALL_ORIGINS)")
 	logFormat := flag.String("log-format", env("WARP_WEB_LOG_FORMAT", "text"), "text or json (WARP_WEB_LOG_FORMAT)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	flag.Parse()
@@ -74,7 +76,7 @@ func run() error {
 	}
 	slog.SetDefault(logger)
 
-	opts := host.Options{Logger: logger, Version: version}
+	opts := host.Options{Logger: logger, Version: version, CallOrigins: strings.Fields(*callOrigins)}
 	mode, target := "proxy", *homeserver
 	if *public != "" {
 		u, err := parseURL("public-homeserver", *public)