Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/components/ConfirmDialog.vue

@@ -0,0 +1,54 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { WBanner, WButton, WDialog, WTextField } from '@warp/ui'
+
+// Confirmation for the actions that can't be taken back. With `typeToConfirm`
+// the admin types the name of what goes (a room ID, a user ID) before the
+// button unlocks, so a slip on a table can't purge the wrong thing.
+
+const props = withDefaults(
+  defineProps<{
+    title: string
+    confirmLabel: string
+    danger?: boolean
+    typeToConfirm?: string
+    busy?: boolean
+    error?: string
+  }>(),
+  { danger: true, typeToConfirm: undefined, busy: false, error: '' },
+)
+
+const open = defineModel<boolean>('open', { default: false })
+const emit = defineEmits<{ confirm: [] }>()
+const typed = ref('')
+
+watch(open, (v) => {
+  if (v) typed.value = ''
+})
+
+const ready = computed(() => !props.typeToConfirm || typed.value.trim() === props.typeToConfirm)
+</script>
+
+<template>
+  <WDialog v-model:open="open" :title="title" :persistent="busy">
+    <div class="body flex flex-col gap-3">
+      <slot />
+    </div>
+    <WTextField
+      v-if="typeToConfirm"
+      v-model="typed"
+      wide
+      mono
+      :label="`Type ${typeToConfirm} to confirm`"
+      autocomplete="off"
+      spellcheck="false"
+    />
+    <WBanner v-if="error" tone="danger">{{ error }}</WBanner>
+    <template #actions>
+      <WButton variant="ghost" :disabled="busy" @click="open = false">Cancel</WButton>
+      <WButton :variant="danger ? 'danger-solid' : 'primary'" :disabled="!ready" :loading="busy" @click="emit('confirm')">
+        {{ confirmLabel }}
+      </WButton>
+    </template>
+  </WDialog>
+</template>