Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/clientapi/clientapi.go

@@ -19,6 +19,7 @@ import (
 
 	"github.com/dariuszjaniak/warp/server/internal/appservice"
 	"github.com/dariuszjaniak/warp/server/internal/config"
+	"github.com/dariuszjaniak/warp/server/internal/delayedevents"
 	"github.com/dariuszjaniak/warp/server/internal/federation"
 	"github.com/dariuszjaniak/warp/server/internal/httputil"
 	"github.com/dariuszjaniak/warp/server/internal/keyserver"
@@ -27,6 +28,7 @@ import (
 	"github.com/dariuszjaniak/warp/server/internal/ratelimit"
 	"github.com/dariuszjaniak/warp/server/internal/roomserver"
 	"github.com/dariuszjaniak/warp/server/internal/settings"
+	"github.com/dariuszjaniak/warp/server/internal/storage"
 	"github.com/dariuszjaniak/warp/server/internal/syncapi"
 	"github.com/dariuszjaniak/warp/server/internal/userapi"
 )
@@ -48,6 +50,9 @@ type ClientAPI struct {
 	regTokens     *userapi.RegistrationTokens
 	appservices   *appservice.API
 	turn          config.TURN
+	delayed       *delayedevents.Service
+	rtcTransports []RTCTransport
+	openID        storage.OpenIDTokenStore
 	log           *slog.Logger
 	now           func() time.Time
 
@@ -145,6 +150,20 @@ type Options struct {
 	// TURN is the relay handed to clients for calls.
 	TURN config.TURN
 
+	// RTC is the group call backend, listed at the MSC4143 transports
+	// endpoint.
+	RTC config.RTC
+
+	// DelayedEvents schedules MSC4140 delayed events. Nil, or a service
+	// with delayed events switched off, leaves the endpoints unregistered
+	// and refuses the delay parameter.
+	DelayedEvents *delayedevents.Service
+
+	// OpenIDTokens keeps the OpenID tokens a user hands third parties,
+	// such as the LiveKit JWT service of a group call. Nil leaves the
+	// OpenID endpoints unregistered.
+	OpenIDTokens storage.OpenIDTokenStore
+
 	// TrustXForwardedFor takes the client address from the proxy header.
 	TrustXForwardedFor bool
 
@@ -205,6 +224,9 @@ func New(opts Options) (*ClientAPI, error) {
 		regTokens:     opts.RegistrationTokens,
 		appservices:   opts.AppServices,
 		turn:          opts.TURN,
+		delayed:       opts.DelayedEvents,
+		rtcTransports: RTCTransports(opts.RTC.LiveKitServiceURL),
+		openID:        opts.OpenIDTokens,
 		log:           opts.Logger,
 		now:           opts.Now,
 		uia:           newUIAStore(uiaSessionTTL, opts.Now),
@@ -274,6 +296,9 @@ func (c *ClientAPI) RegisterRoutes(r *httputil.Router) {
 
 	// Calls: the relay a client sets its peer connection up with.
 	c.authed(r, "GET "+v3+"/voip/turnServer", c.limitDefault, c.handleTurnServer)
+	c.registerOpenIDRoutes(r)
+	c.registerDelayedEventRoutes(r)
+	c.registerRTCRoutes(r)
 
 	// Devices.
 	c.authed(r, "GET "+v3+"/devices", c.limitDefault, c.handleGetDevices)