Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/clientapi/sync_test.go

@@ -260,7 +260,7 @@ func TestSyncRejectsAnUnreadableToken(t *testing.T) {
 	// "s-1" is not here: a negative event position is a /messages token
 	// from inside backfilled history, and a valid ?since=. Only the event
 	// stream goes below zero.
-	for _, since := range []string{"nonsense", "s1_-1", "sx", "s1_2_3_4_5_6_7_8"} {
+	for _, since := range []string{"nonsense", "s1_-1", "sx", "s1_2_3_4_5_6_7_8_9"} {
 		rec := ts.get("/_matrix/client/v3/sync?since="+url.QueryEscape(since), alice.AccessToken)
 		expectError(t, rec, http.StatusBadRequest, "M_INVALID_PARAM")
 	}
@@ -404,6 +404,44 @@ func TestSyncReportsALeaveAndThenStops(t *testing.T) {
 	}
 }
 
+func TestSyncIncrementalSendsARoomJoinedInTheWindowInFull(t *testing.T) {
+	ts := newTestServer(t, nil)
+	alice := ts.register("alice", "correct-horse-battery-staple")
+	bob := ts.register("bob", "hunter2-hunter2-hunter2")
+	roomID := ts.createRoom(alice, map[string]any{"preset": "public_chat", "name": "Carthage"})
+	ts.sendMessage(alice, roomID, "before bob joined")
+
+	since := ts.sync(bob, "").NextBatch
+	expectStatus(t, ts.post("/_matrix/client/v3/rooms/"+url.PathEscape(roomID)+"/join",
+		bob.AccessToken, map[string]any{}), http.StatusOK)
+
+	// To bob the room is new: he gets it as an initial sync would give it,
+	// the history he may see and the state, not just his own join.
+	room, ok := ts.sync(bob, since).Rooms.Join[roomID]
+	if !ok {
+		t.Fatal("the joined room is not in the join section")
+	}
+	if got := bodiesOf(room.Timeline.Events); !contains(got, "before bob joined") {
+		t.Errorf("timeline = %v, want the history before the join", got)
+	}
+	all := append(typesOf(room.State.Events), typesOf(room.Timeline.Events)...)
+	for _, want := range []string{"m.room.create", "m.room.name", "m.room.power_levels"} {
+		if !contains(all, want) {
+			t.Errorf("state and timeline = %v, want %s", all, want)
+		}
+	}
+
+	// A later change to bob's own profile moves his membership too, but is
+	// no new join: that sync carries only what is new.
+	since = ts.sync(bob, since).NextBatch
+	expectStatus(t, ts.put("/_matrix/client/v3/profile/"+url.PathEscape(bob.UserID)+"/displayname",
+		bob.AccessToken, map[string]any{"displayname": "Bob"}), http.StatusOK)
+	room = ts.sync(bob, since).Rooms.Join[roomID]
+	if got := bodiesOf(room.Timeline.Events); contains(got, "before bob joined") {
+		t.Errorf("a profile change resent the history: %v", got)
+	}
+}
+
 func TestSyncSummaryNamesARoomWithNoName(t *testing.T) {
 	ts := newTestServer(t, nil)
 	alice := ts.register("alice", "correct-horse-battery-staple")