Phase 7: E2EE support

Implements PLAN.md Phase 7: the server half of end-to-end encryption.
Devices upload identity, one-time and fallback keys; other devices query
and claim them, across servers too, and every one-time key is handed out
exactly once. Cross-signing, signature uploads, device list tracking and
server-side key backup complete the set.

internal/keyserver is the component. Keys are stored in canonical JSON
so that re-uploading the same key is a byte comparison, and signatures
uploaded later are kept apart from the key they sign and merged in on
read, so a key's own JSON stays what its owner uploaded. Device keys must
be for the caller's own device; cross-signing keys must be the
uploader's, carry the right usage and, for self- and user-signing keys,
be signed by the master key. Signatures are verified against the key as
stored. Replacing a master key asks for the password; a first upload or
an upload of the keys already stored does not, as the spec allows. A
signature of another user's master key is shown only to the user who
made it and never federated.

Every write that changes what /keys/query answers moves the device list
stream in the same transaction, one position per device, and wakes the
syncs of everyone sharing a room. The stream is the sixth field of a sync
token; older tokens still parse. The syncapi works out device_lists
changed and left from the stream and from membership moves in the
window, skipping invites and knocks, and reports
device_one_time_keys_count and device_unused_fallback_key_types, the
latter as [] when empty. GET /keys/changes uses the same logic.

Over federation: /user/keys/query, /user/keys/claim and
/user/devices/{userId}, and m.device_list_update and m.signing_key_update
both ways. Remote keys are not cached; an update about a remote user
sharing a room moves them in the stream so local clients re-query.
Device display names are not sent to other servers. With federation off,
remote users are reported in failures at once.

Deleting a device deletes its keys, through a new userapi
DeviceObserver. Key backup keeps the better copy of each session by the
spec's rule, never reuses a deleted version's number, and answers writes
to a stale version with M_WRONG_ROOM_KEYS_VERSION.

Storage is migration 0008 for sqlite and postgres, with a PocketBase
stub. The Complement target sets gain the key, device list, fallback,
cross-signing and backup tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/userapi/userapi.go

@@ -7,8 +7,9 @@
 // which is also what makes `warp create-account` able to create an account
 // without starting a server.
 //
-// Nothing in this package knows about rooms. Devices get their encryption
-// keys in Phase 7 (keyserver) and their push rules in Phase 8.
+// Nothing in this package knows about rooms. A device's encryption keys
+// are the keyserver's, which hears about a device going away through the
+// DeviceObserver; its push rules arrive in Phase 8.
 package userapi
 
 import (
@@ -67,8 +68,30 @@ type API struct {
 
 	// lastSeen throttles the last-seen bookkeeping; see RecordActivity.
 	lastSeen sync.Map
+
+	// observer hears about deleted and renamed devices; nil hears nothing.
+	observer DeviceObserver
 }
 
+// DeviceObserver is told about changes to devices that something else
+// keeps state for: the keyserver, whose keys for a deleted device have to
+// go with it. *keyserver.API satisfies it.
+//
+// It is called after the change has been made, on the request path, and
+// must not fail it: the device is already gone.
+type DeviceObserver interface {
+	// DevicesDeleted is called with the deleted device IDs, or with none
+	// when every device of the user was deleted.
+	DevicesDeleted(ctx context.Context, localpart string, deviceIDs []string)
+
+	// DeviceRenamed is called when a device's display name changes.
+	DeviceRenamed(ctx context.Context, localpart, deviceID string)
+}
+
+// SetDeviceObserver connects the observer. It is a setter because the
+// keyserver is built after the userapi it reads devices from.
+func (a *API) SetDeviceObserver(o DeviceObserver) { a.observer = o }
+
 // Options configure the component.
 type Options struct {
 	// ServerName is the Matrix server name; it becomes the domain part of
@@ -438,16 +461,28 @@ func (a *API) Devices(ctx context.Context, localpart string) ([]storage.Device,
 
 // SetDeviceDisplayName renames a device.
 func (a *API) SetDeviceDisplayName(ctx context.Context, localpart, deviceID, displayName string) error {
-	return a.store.SetDeviceDisplayName(ctx, localpart, deviceID, displayName)
+	if err := a.store.SetDeviceDisplayName(ctx, localpart, deviceID, displayName); err != nil {
+		return err
+	}
+	if a.observer != nil {
+		a.observer.DeviceRenamed(ctx, localpart, deviceID)
+	}
+	return nil
 }
 
 // DeleteDevices revokes devices and their tokens. It is what /logout,
 // /delete_devices and DELETE /devices/{id} all end up calling.
 func (a *API) DeleteDevices(ctx context.Context, localpart string, deviceIDs []string) error {
+	if len(deviceIDs) == 0 {
+		return nil
+	}
 	if _, err := a.store.DeleteDevices(ctx, localpart, deviceIDs); err != nil {
 		return err
 	}
 	a.forgetLastSeen(localpart, deviceIDs...)
+	if a.observer != nil {
+		a.observer.DevicesDeleted(ctx, localpart, deviceIDs)
+	}
 	return nil
 }
 
@@ -457,6 +492,9 @@ func (a *API) DeleteAllDevices(ctx context.Context, localpart string) error {
 		return err
 	}
 	a.forgetLastSeen(localpart)
+	if a.observer != nil {
+		a.observer.DevicesDeleted(ctx, localpart, nil)
+	}
 	return nil
 }