Merge upstream v1.12.26 - reconnect the fork to Element Web (management #0099)

The repo had no upstream ancestry: a whole tree arrived in one commit in May, so
every update meant re-applying our patches by hand onto a fresh checkout, and a file
Element moved would take our lines with it silently.

The real base was found by measuring tree distance across develop rather than trusting
the changelog: deadd548, not the v1.12.17 tag. With that set as a temporary graft, this
merge computed as a proper three-way merge - 32 conflicts instead of 1757.

Resolutions, each decided rather than defaulted:

- 24 GitHub workflows stay deleted; we build on GitLab CI.
- MImageBody.tsx is gone upstream, migrated to MVVM. Our ClamAV error label moved into
  ImageBodyViewModel.computeErrorLabel, ahead of the DecryptError branch, matching what
  VideoBodyViewModel and FileBodyViewModel already do.
- Upstream extracted the room list item body into RoomListItemContent. Our call
  participants list and its getInitials helper moved there; both sides' CSS classes and
  both sides' props are kept.
- matrix-js-sdk follows upstream at 42.2.0 - our git ref pin was a workaround for a
  stale ref, and following upstream is the point of this merge.
- Element Call stays ours. Checked before deciding: @element-hq/element-call-embedded
  is referenced nowhere in the tree, while webpack.config.ts needs
  @sorb/threadnet-call-embedded, so taking upstream's line would have deleted the noise
  suppression from #0054 without a word.

The lockfile was regenerated with pnpm 11.20.0, which upstream now requires through
devEngines. CI already runs corepack enable, and onFail: download makes it fetch that
version by itself.

Not yet accepted: this needs a build and the ClamAV functional test - send an encrypted
file, receive a rejected one - before it goes near main.

apps/web/res/css/views/settings/tabs/user/_KeyboardUserSettingsTab.pcss

@@ -12,7 +12,7 @@ Please see LICENSE files in the repository root for full details.
     padding: 0;
     width: 100%;
     display: grid;
-    gap: $spacing-4;
+    gap: var(--cpd-space-1x);
 }
 
 .mx_KeyboardShortcut_shortcutRow,
@@ -23,10 +23,10 @@ Please see LICENSE files in the repository root for full details.
 }
 
 .mx_KeyboardShortcut_shortcutRow {
-    column-gap: $spacing-8;
+    column-gap: var(--cpd-space-2x);
 }
 
 .mx_KeyboardShortcut {
     flex-wrap: nowrap;
-    column-gap: $spacing-4;
+    column-gap: var(--cpd-space-1x);
 }

apps/web/res/css/views/settings/tabs/user/_SecurityUserSettingsTab.pcss

@@ -8,7 +8,7 @@ Please see LICENSE files in the repository root for full details.
 .mx_SecurityUserSettingsTab_bulkOptions {
     display: flex;
     flex-direction: row;
-    column-gap: $spacing-8;
+    column-gap: var(--cpd-space-2x);
 }
 
 .mx_SecurityUserSettingsTab_ignoredUsers {
@@ -18,11 +18,11 @@ Please see LICENSE files in the repository root for full details.
 }
 
 .mx_SecurityUserSettingsTab_ignoredUser {
-    margin-bottom: $spacing-4;
+    margin-bottom: var(--cpd-space-1x);
 }
 
 .mx_SecurityUserSettingsTab_ignoredUser .mx_AccessibleButton {
-    margin-right: $spacing-8;
+    margin-right: var(--cpd-space-2x);
 }
 
 .mx_SecurityUserSettingsTab_warning {