Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/cmd/warp-web/main.go

@@ -0,0 +1,139 @@
+// Command warp-web serves the Warp web client. It is optional: a Warp
+// server runs without it, and anyone who wants the client in the browser
+// runs this next to it.
+//
+//	warp-web -homeserver http://localhost:8008 -listen :8080
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/dariuszjaniak/warp/apps/web/internal/client"
+	"github.com/dariuszjaniak/warp/apps/web/internal/host"
+)
+
+// Set with -ldflags "-X main.version=...".
+var version = "0.0.0-dev"
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, "warp-web:", err)
+		os.Exit(1)
+	}
+}
+
+func env(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+func parseURL(name, raw string) (*url.URL, error) {
+	u, err := url.Parse(strings.TrimRight(raw, "/"))
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", name, err)
+	}
+	return u, nil
+}
+
+func run() error {
+	listen := flag.String("listen", env("WARP_WEB_LISTEN", ":8080"), "address to listen on (WARP_WEB_LISTEN)")
+	homeserver := flag.String("homeserver", env("WARP_WEB_HOMESERVER", "http://localhost:8008"),
+		"base URL of the homeserver, proxied for the client (WARP_WEB_HOMESERVER)")
+	public := flag.String("public-homeserver", env("WARP_WEB_PUBLIC_HOMESERVER", ""),
+		"public URL of the homeserver; when set, the browser calls it directly and nothing is proxied (WARP_WEB_PUBLIC_HOMESERVER)")
+	logFormat := flag.String("log-format", env("WARP_WEB_LOG_FORMAT", "text"), "text or json (WARP_WEB_LOG_FORMAT)")
+	showVersion := flag.Bool("version", false, "print the version and exit")
+	flag.Parse()
+
+	if *showVersion {
+		fmt.Println("warp-web", version)
+		return nil
+	}
+
+	var logger *slog.Logger
+	switch *logFormat {
+	case "json":
+		logger = slog.New(slog.NewJSONHandler(os.Stderr, nil))
+	case "text":
+		logger = slog.New(slog.NewTextHandler(os.Stderr, nil))
+	default:
+		return fmt.Errorf("unknown log format %q", *logFormat)
+	}
+	slog.SetDefault(logger)
+
+	opts := host.Options{Logger: logger, Version: version}
+	mode, target := "proxy", *homeserver
+	if *public != "" {
+		u, err := parseURL("public-homeserver", *public)
+		if err != nil {
+			return err
+		}
+		opts.PublicHomeserver = u
+		mode, target = "direct", *public
+	} else {
+		u, err := parseURL("homeserver", *homeserver)
+		if err != nil {
+			return err
+		}
+		opts.Homeserver = u
+	}
+
+	files, built := client.FS()
+	if !built {
+		logger.Warn("the web client was not built into this binary; serving a placeholder page")
+		files = nil
+	}
+	opts.Client = files
+
+	h, err := host.New(opts)
+	if err != nil {
+		return err
+	}
+
+	srv := &http.Server{
+		Addr:              *listen,
+		Handler:           h,
+		ReadHeaderTimeout: 10 * time.Second,
+		// Uploads and downloads of large media pass through here.
+		ReadTimeout:    15 * time.Minute,
+		WriteTimeout:   15 * time.Minute,
+		IdleTimeout:    2 * time.Minute,
+		MaxHeaderBytes: 64 << 10,
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	errc := make(chan error, 1)
+	go func() {
+		logger.Info("warp-web listening", "addr", *listen, "homeserver", target, "mode", mode, "version", version)
+		errc <- srv.ListenAndServe()
+	}()
+
+	select {
+	case err := <-errc:
+		if !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+		return nil
+	case <-ctx.Done():
+	}
+
+	logger.Info("shutting down")
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	return srv.Shutdown(shutdownCtx)
+}