Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/Dockerfile

@@ -0,0 +1,52 @@
+# warp-web — the optional web client, as its own container.
+#
+# Build from the repository root (the client uses the shared apps/ui package):
+#
+#   docker build -t warp-web -f apps/web/Dockerfile .
+#   docker run -p 8080:8080 -e WARP_WEB_HOMESERVER=http://warp:8008 warp-web
+
+FROM node:22-alpine AS web
+
+WORKDIR /src
+RUN corepack enable
+
+# Lockfile and manifests first, so the package store survives source changes.
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY apps/ui/package.json ./apps/ui/
+COPY apps/web/package.json ./apps/web/
+RUN pnpm install --frozen-lockfile --filter @warp/web...
+
+COPY apps/ui ./apps/ui
+COPY apps/web ./apps/web
+RUN pnpm --filter @warp/web build
+
+
+FROM golang:1.26-alpine AS build
+
+WORKDIR /src/apps/web
+COPY apps/web/go.mod ./
+COPY apps/web/cmd ./cmd
+COPY apps/web/internal ./internal
+COPY --from=web /src/apps/web/internal/client/build/dist ./internal/client/build/dist
+
+ARG VERSION=0.0.0-dev
+ENV CGO_ENABLED=0 GOWORK=off
+RUN go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/warp-web ./cmd/warp-web
+
+
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates curl && adduser -D -u 10003 warp-web
+COPY --from=build /out/warp-web /usr/local/bin/warp-web
+USER warp-web
+
+ENV WARP_WEB_LISTEN=":8080" \
+    WARP_WEB_HOMESERVER="http://warp:8008" \
+    WARP_WEB_LOG_FORMAT="json"
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:8080/healthz || exit 1
+
+ENTRYPOINT ["warp-web"]