Phase 7: E2EE support

Implements PLAN.md Phase 7: the server half of end-to-end encryption.
Devices upload identity, one-time and fallback keys; other devices query
and claim them, across servers too, and every one-time key is handed out
exactly once. Cross-signing, signature uploads, device list tracking and
server-side key backup complete the set.

internal/keyserver is the component. Keys are stored in canonical JSON
so that re-uploading the same key is a byte comparison, and signatures
uploaded later are kept apart from the key they sign and merged in on
read, so a key's own JSON stays what its owner uploaded. Device keys must
be for the caller's own device; cross-signing keys must be the
uploader's, carry the right usage and, for self- and user-signing keys,
be signed by the master key. Signatures are verified against the key as
stored. Replacing a master key asks for the password; a first upload or
an upload of the keys already stored does not, as the spec allows. A
signature of another user's master key is shown only to the user who
made it and never federated.

Every write that changes what /keys/query answers moves the device list
stream in the same transaction, one position per device, and wakes the
syncs of everyone sharing a room. The stream is the sixth field of a sync
token; older tokens still parse. The syncapi works out device_lists
changed and left from the stream and from membership moves in the
window, skipping invites and knocks, and reports
device_one_time_keys_count and device_unused_fallback_key_types, the
latter as [] when empty. GET /keys/changes uses the same logic.

Over federation: /user/keys/query, /user/keys/claim and
/user/devices/{userId}, and m.device_list_update and m.signing_key_update
both ways. Remote keys are not cached; an update about a remote user
sharing a room moves them in the stream so local clients re-query.
Device display names are not sent to other servers. With federation off,
remote users are reported in failures at once.

Deleting a device deletes its keys, through a new userapi
DeviceObserver. Key backup keeps the better copy of each session by the
spec's rule, never reuses a deleted version's number, and answers writes
to a stale version with M_WRONG_ROOM_KEYS_VERSION.

Storage is migration 0008 for sqlite and postgres, with a PocketBase
stub. The Complement target sets gain the key, device list, fallback,
cross-signing and backup tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/syncapi/token_test.go

@@ -17,8 +17,8 @@ func TestTokenRoundTrips(t *testing.T) {
 		{"events and receipts", syncapi.Token{PDU: 12, Receipt: 3}, "s12_3"},
 		{
 			"every stream",
-			syncapi.Token{PDU: 1, Receipt: 2, ToDevice: 3, AccountData: 4, Presence: 5},
-			"s1_2_3_4_5",
+			syncapi.Token{PDU: 1, Receipt: 2, ToDevice: 3, AccountData: 4, Presence: 5, DeviceList: 6},
+			"s1_2_3_4_5_6",
 		},
 		{
 			// /messages pages back into history backfilled from other
@@ -81,13 +81,13 @@ func TestParseTokenAcceptsAShortToken(t *testing.T) {
 
 func TestParseTokenRejectsNonsense(t *testing.T) {
 	for _, raw := range []string{
-		"nonsense",     // no prefix
-		"t1_2",         // a prefix this build does not write
-		"s",            // a prefix and nothing else
-		"s1_-1",        // a negative position outside the event stream
-		"sx",           // not a number
-		"s1_",          // a trailing separator
-		"s1_2_3_4_5_6", // more positions than there are streams
+		"nonsense",       // no prefix
+		"t1_2",           // a prefix this build does not write
+		"s",              // a prefix and nothing else
+		"s1_-1",          // a negative position outside the event stream
+		"sx",             // not a number
+		"s1_",            // a trailing separator
+		"s1_2_3_4_5_6_7", // more positions than there are streams
 		"s1.5",
 	} {
 		if _, err := syncapi.ParseToken(raw); err == nil {