Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/internal/host/host_test.go

@@ -304,3 +304,35 @@ func TestNewValidatesHomeserver(t *testing.T) {
 		}
 	}
 }
+
+func TestProxiesWellKnownClient(t *testing.T) {
+	up := newUpstream(t)
+	h := newHandler(t, up, true)
+	rec := do(h, http.MethodGet, "/.well-known/matrix/client", nil)
+	if rec.Code != 200 || len(up.hits) != 1 || up.hits[0].URL.Path != "/.well-known/matrix/client" {
+		t.Fatalf("status %d, hits %d", rec.Code, len(up.hits))
+	}
+	// The server delegation document stays private.
+	if rec := do(h, http.MethodGet, "/.well-known/matrix/server", nil); rec.Code == 200 && len(up.hits) > 1 {
+		t.Errorf("/.well-known/matrix/server was proxied")
+	}
+}
+
+func TestCallOriginsJoinConnectSrc(t *testing.T) {
+	up := newUpstream(t)
+	target, _ := url.Parse(up.srv.URL)
+	h, err := New(Options{Homeserver: target, Client: clientFS,
+		CallOrigins: []string{"https://livekit-jwt.warp.example/", "wss://livekit.warp.example"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec := do(h, http.MethodGet, "/", nil)
+	want := "connect-src 'self' https://livekit-jwt.warp.example wss://livekit.warp.example https://livekit.warp.example;"
+	if csp := rec.Header().Get("Content-Security-Policy"); !strings.Contains(csp, want) {
+		t.Errorf("CSP %q", csp)
+	}
+
+	if _, err := New(Options{Homeserver: target, CallOrigins: []string{"https://x.example/path"}}); err == nil {
+		t.Error("a call origin with a path was accepted")
+	}
+}