Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/clientapi/ephemeral_test.go

@@ -44,15 +44,27 @@ func TestTypingReachesTheOtherMembers(t *testing.T) {
 		t.Errorf("user_ids = %v, want [%s]", users, alice.UserID)
 	}
 
+	// While she goes on typing, the next sync has nothing new to say. A
+	// sync that repeated it would return at once every time: clients would
+	// spin instead of long-polling.
+	again := ts.sync(bob, result.NextBatch)
+	if _, ok := ephemeralEvent(again, roomID, "m.typing"); ok {
+		t.Error("an unchanged m.typing was reported again")
+	}
+
 	// Stopping is reported as the list without them, not as nothing: a
 	// client replaces what it had.
 	expectStatus(t, ts.put(fmt.Sprintf("/_matrix/client/v3/rooms/%s/typing/%s",
 		url.PathEscape(roomID), url.PathEscape(alice.UserID)),
 		alice.AccessToken, map[string]any{"typing": false}), http.StatusOK)
 
-	stopped := ts.sync(bob, result.NextBatch)
-	if _, ok := ephemeralEvent(stopped, roomID, "m.typing"); ok {
-		t.Error("m.typing was still reported after the notification was withdrawn")
+	stopped := ts.sync(bob, again.NextBatch)
+	typing, ok = ephemeralEvent(stopped, roomID, "m.typing")
+	if !ok {
+		t.Fatal("stopping was not reported")
+	}
+	if users, _ := typing.Content["user_ids"].([]any); len(users) != 0 {
+		t.Errorf("user_ids = %v after she stopped, want none", users)
 	}
 }