Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -289,3 +289,89 @@ jobs:
           status="$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8009/_matrix/client/v3/sync \
             -H "Authorization: Bearer $token")"
           test "$status" = "404"
+
+  web:
+    name: Web client
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: server/go.sum
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck and build the frontend
+        run: |
+          pnpm --filter @warp/web typecheck
+          pnpm --filter @warp/web build
+
+      - name: Verify formatting
+        working-directory: apps/web
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "These files need gofmt:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet and test warp-web
+        working-directory: apps/web
+        run: |
+          go vet ./...
+          go test -count=1 ./...
+
+      - name: Smoke test warp-web against the homeserver
+        run: |
+          set -euo pipefail
+          make build
+          (cd apps/web && go build -o ../../bin/warp-web ./cmd/warp-web)
+          sed 's/^  server_name: .*/  server_name: ci.example/' warp.yaml.example > warp.yaml
+          ./bin/warp generate-keys
+          ./bin/warp migrate
+          ./bin/warp create-account --username ci-user --password hunter2hunter2
+          ./bin/warp serve &
+          ./bin/warp-web -homeserver http://127.0.0.1:8008 -listen 127.0.0.1:8080 &
+          trap 'kill $(jobs -p) 2>/dev/null || true' EXIT
+
+          for _ in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8008/healthz >/dev/null 2>&1 &&
+               curl -fsS http://127.0.0.1:8080/healthz >/dev/null 2>&1; then
+              break
+            fi
+            sleep 1
+          done
+
+          # The client is embedded, its routes fall back to index.html, and
+          # its runtime config says to use the proxy.
+          curl -fsS http://127.0.0.1:8080/ | grep -q '<div id="app">'
+          curl -fsS 'http://127.0.0.1:8080/room/!abc:ci.example' | grep -q '<div id="app">'
+          curl -fsS http://127.0.0.1:8080/config.json | grep -q '"homeserver_url":""'
+
+          # The client API goes through the proxy, trailing-slash routes too...
+          token="$(curl -fsS http://127.0.0.1:8080/_matrix/client/v3/login -d '{
+            "type": "m.login.password",
+            "identifier": {"type": "m.id.user", "user": "ci-user"},
+            "password": "hunter2hunter2"
+          }' | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p')"
+          test -n "$token"
+          curl -fsS 'http://127.0.0.1:8080/_matrix/client/v3/sync?timeout=0' \
+            -H "Authorization: Bearer $token" | grep -q '"next_batch"'
+          curl -fsS http://127.0.0.1:8080/_matrix/client/v3/pushrules/ \
+            -H "Authorization: Bearer $token" | grep -q '"global"'
+
+          # ...and the admin API does not.
+          status="$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/_warp/admin/v1/stats \
+            -H "Authorization: Bearer $token")"
+          test "$status" = "404"