Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/roomserver/create.go

@@ -432,6 +432,10 @@ func (r *API) powerLevelsContent(req CreateRoomRequest, preset string, rules roo
 			"m.room.avatar":             auth.DefaultStateDefault,
 			TypeEncryption:              100,
 			"m.room.server_acl":         100,
+			// Joining a group call is a state event of the member's own
+			// (MatrixRTC, MSC3401), so anyone who may talk in the room
+			// may also join its call. Starting one is not a separate act.
+			TypeCallMember: 0,
 		},
 		"notifications": map[string]any{"room": auth.DefaultNotification},
 	}
@@ -538,3 +542,7 @@ func mergeJSON(base, override json.RawMessage) (json.RawMessage, error) {
 	}
 	return json.Marshal(merged)
 }
+
+// TypeCallMember is a member's state in a room's group call (MatrixRTC).
+// It is still under its MSC3401 name, which is what clients send.
+const TypeCallMember = "org.matrix.msc3401.call.member"