Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/deployment.md

@@ -135,6 +135,21 @@ already public behind its own proxy, set `WARP_WEB_PUBLIC_HOMESERVER` to
 its URL instead: the browser then calls it directly and warp-web serves
 only the client. See [apps/web](../apps/web/README.md).
 
+## Calls
+
+Calls need a LiveKit SFU and the LiveKit JWT service next to Warp.
+For a local try, `deploy/compose/calls.yml` adds both:
+
+```sh
+cd deploy/compose
+WARP_REGISTRATION_ENABLED=true docker compose -f docker-compose.yml -f calls.yml --profile web up -d --build
+```
+
+The Helm chart can run the JWT service (`calls.jwtService.enabled`) and
+sets `client_api.rtc.livekit_service_url` from it; LiveKit itself runs
+from its own chart. See [calls.md](calls.md) for how the pieces find each
+other and what production needs.
+
 ## Reverse proxy
 
 Behind a proxy that terminates TLS: