Phase 7: E2EE support

Implements PLAN.md Phase 7: the server half of end-to-end encryption.
Devices upload identity, one-time and fallback keys; other devices query
and claim them, across servers too, and every one-time key is handed out
exactly once. Cross-signing, signature uploads, device list tracking and
server-side key backup complete the set.

internal/keyserver is the component. Keys are stored in canonical JSON
so that re-uploading the same key is a byte comparison, and signatures
uploaded later are kept apart from the key they sign and merged in on
read, so a key's own JSON stays what its owner uploaded. Device keys must
be for the caller's own device; cross-signing keys must be the
uploader's, carry the right usage and, for self- and user-signing keys,
be signed by the master key. Signatures are verified against the key as
stored. Replacing a master key asks for the password; a first upload or
an upload of the keys already stored does not, as the spec allows. A
signature of another user's master key is shown only to the user who
made it and never federated.

Every write that changes what /keys/query answers moves the device list
stream in the same transaction, one position per device, and wakes the
syncs of everyone sharing a room. The stream is the sixth field of a sync
token; older tokens still parse. The syncapi works out device_lists
changed and left from the stream and from membership moves in the
window, skipping invites and knocks, and reports
device_one_time_keys_count and device_unused_fallback_key_types, the
latter as [] when empty. GET /keys/changes uses the same logic.

Over federation: /user/keys/query, /user/keys/claim and
/user/devices/{userId}, and m.device_list_update and m.signing_key_update
both ways. Remote keys are not cached; an update about a remote user
sharing a room moves them in the stream so local clients re-query.
Device display names are not sent to other servers. With federation off,
remote users are reported in failures at once.

Deleting a device deletes its keys, through a new userapi
DeviceObserver. Key backup keeps the better copy of each session by the
spec's rule, never reuses a deleted version's number, and answers writes
to a stale version with M_WRONG_ROOM_KEYS_VERSION.

Storage is migration 0008 for sqlite and postgres, with a PocketBase
stub. The Complement target sets gain the key, device list, fallback,
cross-signing and backup tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/syncapi/token.go

@@ -18,10 +18,12 @@ import (
 //
 // The wire form is
 //
-//	s{pdu}_{receipt}_{to_device}_{account_data}_{presence}
+//	s{pdu}_{receipt}_{to_device}_{account_data}_{presence}_{device_list}
 //
 // with trailing zeroes left off, so a client that has only ever seen room
-// events carries "s12" rather than "s12_0_0_0_0". The leading "s" is there
+// events carries "s12" rather than "s12_0_0_0_0_0". The device list
+// position came with Phase 7 and was added at the end, which is what lets
+// every token handed out before it go on parsing. The leading "s" is there
 // to make a token recognisable in a log and to leave room for a second
 // token shape later — Simplified Sliding Sync (PLAN.md phase 10) has its
 // own — without any ambiguity about which is which.
@@ -35,8 +37,12 @@ type Token struct {
 	ToDevice    int64
 	AccountData int64
 	Presence    int64
+	DeviceList  int64
 }
 
+// tokenPositions is how many positions a token carries.
+const tokenPositions = 6
+
 // tokenPrefix marks a classic /sync token.
 const tokenPrefix = "s"
 
@@ -46,7 +52,7 @@ func (t Token) IsInitial() bool { return t == Token{} }
 
 // String renders the wire form.
 func (t Token) String() string {
-	parts := []int64{t.PDU, t.Receipt, t.ToDevice, t.AccountData, t.Presence}
+	parts := []int64{t.PDU, t.Receipt, t.ToDevice, t.AccountData, t.Presence, t.DeviceList}
 	// Trailing zeroes carry no information, and leaving them off keeps the
 	// common token short.
 	last := 0
@@ -88,12 +94,12 @@ func ParseToken(raw string) (Token, error) {
 	}
 
 	fields := strings.Split(body, "_")
-	if len(fields) > 5 {
-		return Token{}, fmt.Errorf("%q is not a sync token: it has %d positions, this server writes at most 5",
-			raw, len(fields))
+	if len(fields) > tokenPositions {
+		return Token{}, fmt.Errorf("%q is not a sync token: it has %d positions, this server writes at most %d",
+			raw, len(fields), tokenPositions)
 	}
 
-	var positions [5]int64
+	var positions [tokenPositions]int64
 	for i, field := range fields {
 		value, err := strconv.ParseInt(field, 10, 64)
 		// The PDU position alone may be negative: /messages hands out
@@ -110,6 +116,7 @@ func ParseToken(raw string) (Token, error) {
 		ToDevice:    positions[2],
 		AccountData: positions[3],
 		Presence:    positions[4],
+		DeviceList:  positions[5],
 	}, nil
 }
 
@@ -122,6 +129,7 @@ func tokenAt(positions storage.StreamPositions) Token {
 		ToDevice:    positions.ToDevice,
 		AccountData: positions.AccountData,
 		Presence:    positions.Presence,
+		DeviceList:  positions.DeviceList,
 	}
 }