Group voice and video calls with MatrixRTC and LiveKit

Every call in the web client now goes through MatrixRTC with a LiveKit
SFU, the model Element Call and Element X use; the legacy 1:1 m.call.*
calls are gone. In a room of two the other person is rung and can answer
or decline; in a bigger room a banner offers to join the call. Calls show
a grid of participant tiles with mute, camera, screen sharing and leave,
and media is end-to-end encrypted in encrypted rooms.

Server:
- MSC4140 delayed events (send/state with a delay, plus the
  delayed_events list/restart/cancel/send API), stored and scheduled, so
  a member whose client drops off is taken out of the call.
- POST /user/{userId}/openid/request_token, which lk-jwt-service uses to
  hand out LiveKit tokens.
- org.matrix.msc4143.rtc_foci in /.well-known/matrix/client, configured
  under client_api.rtc.
- Room presets let members send call membership state.
- Migration 0014 for both SQL dialects.

Deploy: LiveKit and lk-jwt-service in compose (calls.yml) and the helm
chart. Docs: docs/calls.md, configuration and deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/storage/sqlite/migrations/0014_delayed_events_openid.sql

@@ -0,0 +1,50 @@
+-- Group calls: delayed events (MSC4140) and OpenID tokens.
+
+-- An event a client asked to have sent later. A MatrixRTC client schedules
+-- its own "left the call" this way and keeps pushing it back while it is
+-- in the call, so a client that crashes or loses its connection still
+-- leaves.
+--
+-- state_key is NULL for a timeline event. finalised_at_ms is 0 while the
+-- event is scheduled; once it has been sent or cancelled the row is kept
+-- for a while with its outcome, so a client can find out what happened.
+CREATE TABLE IF NOT EXISTS delayed_events (
+    delay_id          TEXT   NOT NULL PRIMARY KEY,
+    user_id           TEXT   NOT NULL,
+    device_id         TEXT   NOT NULL DEFAULT '',
+    room_id           TEXT   NOT NULL,
+    event_type        TEXT   NOT NULL,
+    state_key         TEXT,
+    content           TEXT   NOT NULL,
+    delay_ms          BIGINT NOT NULL,
+    running_since_ms  BIGINT NOT NULL,
+    send_at_ms        BIGINT NOT NULL,
+    finalised_at_ms   BIGINT NOT NULL DEFAULT 0,
+    outcome           TEXT   NOT NULL DEFAULT '',
+    reason            TEXT   NOT NULL DEFAULT '',
+    event_id          TEXT   NOT NULL DEFAULT '',
+    error             TEXT   NOT NULL DEFAULT ''
+);
+
+CREATE INDEX IF NOT EXISTS delayed_events_user_idx
+    ON delayed_events (user_id, finalised_at_ms);
+
+-- The scheduler asks for what is due next among the scheduled events.
+CREATE INDEX IF NOT EXISTS delayed_events_due_idx
+    ON delayed_events (finalised_at_ms, send_at_ms);
+
+-- Someone else setting a piece of state cancels the delayed events that
+-- would have overwritten it.
+CREATE INDEX IF NOT EXISTS delayed_events_state_idx
+    ON delayed_events (room_id, event_type, state_key, finalised_at_ms);
+
+-- OpenID tokens: what a user hands a third party (the LiveKit JWT service)
+-- so it can ask this server who they are. Stored by hash, like access
+-- tokens.
+CREATE TABLE IF NOT EXISTS openid_tokens (
+    token_hash    TEXT   NOT NULL PRIMARY KEY,
+    user_id       TEXT   NOT NULL,
+    expires_at_ms BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS openid_tokens_expiry_idx ON openid_tokens (expires_at_ms);