Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -128,6 +128,38 @@ admin-test: ## Typecheck the frontend and test warp-admin
 admin-docker: ## Build the warp-admin container image
 	docker build -t $(ADMIN_IMAGE):$(VERSION) -f $(ADMIN_DIR)/Dockerfile .
 
+# --- Web client (apps/web) --------------------------------------------
+# Optional too: warp-web serves the built client and proxies its Matrix
+# requests to the homeserver.
+
+WEB_DIR   := apps/web
+WEB_IMAGE ?= warp-web
+
+.PHONY: web-web
+web-web: ## Build the web client frontend into apps/web/internal/client/build/dist
+	$(PNPM) --filter @warp/web build
+
+.PHONY: web
+web: web-web ## Build bin/warp-web with the client embedded
+	cd $(WEB_DIR) && $(GO) build -ldflags "-X main.version=$(VERSION)" -o ../../$(BIN_DIR)/warp-web$(EXE) ./cmd/warp-web
+
+.PHONY: web-run
+web-run: web ## Run warp-web against http://localhost:8008
+	./$(BIN_DIR)/warp-web$(EXE) -homeserver http://localhost:8008
+
+.PHONY: web-dev
+web-dev: ## Run the client with hot reload on :5175, proxied to localhost:8008
+	$(PNPM) --filter @warp/web dev
+
+.PHONY: web-test
+web-test: ## Typecheck the frontend and test warp-web
+	$(PNPM) -r typecheck
+	cd $(WEB_DIR) && $(GO) vet ./... && $(GO) test ./...
+
+.PHONY: web-docker
+web-docker: ## Build the warp-web container image
+	docker build -t $(WEB_IMAGE):$(VERSION) -f $(WEB_DIR)/Dockerfile .
+
 .PHONY: complement-image
 complement-image: ## Build the Complement homeserver image
 	docker build -t $(COMPLEMENT_IMAGE) -f $(SERVER_DIR)/test/complement/Dockerfile .