Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/clientapi/voip_test.go

@@ -87,3 +87,27 @@ func TestTurnServerStatic(t *testing.T) {
 		t.Errorf("response = %+v", got)
 	}
 }
+
+func TestRTCTransports(t *testing.T) {
+	const path = "/_matrix/client/unstable/org.matrix.msc4143/rtc/transports"
+	ts := newTestServer(t, func(o *clientapi.Options) {
+		o.RTC = config.RTC{LiveKitServiceURL: "https://livekit-jwt.warp.example/"}
+	})
+	acc := ts.register("alice", "correct horse battery")
+	expectError(t, ts.get(path, ""), http.StatusUnauthorized, "M_MISSING_TOKEN")
+
+	rec := ts.get(path, acc.AccessToken)
+	expectStatus(t, rec, http.StatusOK)
+	got := decode[struct {
+		Transports []map[string]string `json:"rtc_transports"`
+	}](t, rec)
+	if len(got.Transports) != 1 || got.Transports[0]["type"] != "livekit" ||
+		got.Transports[0]["livekit_service_url"] != "https://livekit-jwt.warp.example" {
+		t.Errorf("rtc_transports = %v", got.Transports)
+	}
+
+	// Without a backend there is no endpoint, which is how a client knows.
+	ts = newTestServer(t, nil)
+	acc = ts.register("alice", "correct horse battery")
+	expectError(t, ts.get(path, acc.AccessToken), http.StatusNotFound, "M_UNRECOGNIZED")
+}