Web client (warp-web) with E2EE, and two sync fixes

apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.

apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.

syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
  limited: false, so clients thought they had the whole room. It is now
  read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
  poll returned at once while anybody typed. Typing now has a position
  in the sync token and is reported when it changes, including the empty
  list when the last person stops.

Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/roomserver/query.go

@@ -367,6 +367,22 @@ func (r *API) Membership(ctx context.Context, roomID, userID string) (string, er
 	return entry.Membership, nil
 }
 
+// MembershipBefore returns a user's membership in a room as of just before
+// an event, empty when they had none. Sync asks it of the user's own latest
+// membership event, to tell a join from a profile change.
+func (r *API) MembershipBefore(ctx context.Context, roomID, userID, eventID string) (string, error) {
+	entries, err := r.store.StateBefore(ctx, roomID, eventID)
+	if err != nil {
+		return "", err
+	}
+	for _, e := range entries {
+		if e.Type == event.TypeMember && e.StateKey == userID {
+			return e.Membership, nil
+		}
+	}
+	return "", nil
+}
+
 // roomAndRules reads a room and the rules its events are under.
 func (r *API) roomAndRules(ctx context.Context, roomID string) (storage.Room, roomversion.Rules, error) {
 	room, err := r.store.Room(ctx, roomID)