Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose/docker-compose.yml

@@ -9,7 +9,8 @@
 # docs/deployment.md. With the observability profile, Grafana is on
 # http://localhost:3000 (admin / admin, change it), Prometheus on :9090 and
 # the Jaeger UI on :16686. With the admin profile, the admin panel is on
-# http://localhost:8009.
+# http://localhost:8009; with the web profile, the web client is on
+# http://localhost:8080.
 #
 # Create the first administrator once the server is up:
 #
@@ -82,6 +83,24 @@ services:
     ports:
       - "${WARP_ADMIN_PORT:-8009}:8009"
 
+  # The web client is optional too. Start it with the web profile:
+  #   docker compose --profile web up -d
+  # It is on http://localhost:8080 and proxies the client's Matrix requests
+  # to the homeserver over the compose network.
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    image: warp-web:latest
+    profiles: [web]
+    restart: unless-stopped
+    depends_on:
+      - warp
+    environment:
+      WARP_WEB_HOMESERVER: http://warp:8008
+    ports:
+      - "${WARP_WEB_PORT:-8080}:8080"
+
   prometheus:
     image: prom/prometheus:v3.5.0
     profiles: [observability]