Add a harness for Element Call embedded as a component

`pnpm dev:component` serves a page that stands in for a host application: it
signs in twice against the development backend and shows two calls side by
side, in resizable boxes, with furniture of its own around them. Two devices of
one account, so a real call happens between the two components and anything
Element Call keeps once per process rather than once per call shows itself.

The host bridge is driven by hand and reports both directions in a log along
the bottom, which is the first exercise the theme, hang-up and device-mute
requests have had outside widget mode. Each pane can be unmounted and remounted
to see what Element Call leaves behind, and there is a `position: fixed` dialog
belonging to the host to see whether it covers the calls. The page uses none of
Element Call's design tokens, so anything that looks styled outside a pane came
from Element Call reaching out of its container. It reaches Element Call only
through the component's public interface, which is how the exports missing from
that interface came to light.

Three things about the component build the harness turned up on the way, all
too small to be worth their own commits:

- It copied `public/` into `dist/`, including the developer's own gitignored
  config.json, into output we would publish. `publicDir: false`, as the
  embedded build already does. The sdk build has the same leak; untouched.
- `pnpm lint:externals` now exists, which the build config already claimed it
  did. It reads the external list out of that config and fails if the source
  imports React, the Matrix SDK or LiveKit by a path the list does not name.
  Since the bundler silently ignores the pattern form of that option, an
  unnamed subpath is bundled with no warning at all — which is how a host would
  end up with a second React.
- `lint:oxlint` ran over `src playwright`, so nothing in `component/` had ever
  been linted.

Serving a page also meant the shared plugin list could no longer inject the
app's HTML entry point unconditionally, so that is now optional — and off for
the library build too, which never had an HTML page to inject it into.

vite-component.config.ts

@@ -15,7 +15,11 @@ import { vitePluginsConfig } from "./vite.config";
 // Deliberately not built on top of the full app's config, which exists to
 // produce a page and brings an HTML entry point along with it.
 export default defineConfig(({ mode }) => ({
-  ...vitePluginsConfig({ mode }),
+  ...vitePluginsConfig({ mode, html: false }),
+  // A library has no public directory to serve. Without this the build copies
+  // whatever is in `public` — including the developer's own config.json, which
+  // is not in the repository — into the output we would publish.
+  publicDir: false,
   build: {
     minify: mode === "production",
     sourcemap: true,
@@ -36,7 +40,10 @@ export default defineConfig(({ mode }) => ({
       // SDK as `matrix-js-sdk/lib/…`, and a bare "matrix-js-sdk" would not
       // catch those — while the pattern and callback forms of this option are
       // silently ignored by the bundler, so they cannot be used to cover them.
-      // `pnpm lint:externals` fails if an import appears that is not listed.
+      // `pnpm lint:externals` reads this list and fails if the source imports
+      // one of these packages by a path it does not name; a few entries below
+      // are there only because the standalone app imports them, which costs
+      // nothing.
       external: [
         "react",
         "react/jsx-runtime",
@@ -44,8 +51,10 @@ export default defineConfig(({ mode }) => ({
         "react-dom/client",
         "livekit-client",
         "matrix-js-sdk",
+        "matrix-js-sdk/lib/browser-index",
         "matrix-js-sdk/lib/client",
         "matrix-js-sdk/lib/crypto-api",
+        "matrix-js-sdk/lib/indexeddb-worker",
         "matrix-js-sdk/lib/logger",
         "matrix-js-sdk/lib/matrix",
         "matrix-js-sdk/lib/matrixrtc",