chore(deps): matrix-js-sdk 41.7 -> 44.0 (#201)

Picks up three releases of MatrixRTC / delayed-event fixes and
matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0.

SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so
the native-OAuth sign-in is ported:
- login discovers the auth server via /auth_metadata, registers with
  OAuth2.registerClient, and keeps the PKCE verifier + device in its own
  sessionStorage entry keyed by `state` (single use; CSRF check);
- refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16
  cross-tab protection is kept by a narrow guard on refresh-token grants
  (the SDK calls the global fetch for OAuth, not fetchFn), which
  serialises them with a Web Lock and adopts a sibling tab's tokens;
- logout and forced logout revoke via mx.logout() (the SDK revokes at
  the auth server for OAuth sessions);
- the callback page parsed its params on every render, re-running the
  single-use code exchange in a loop; parsed once now.

Also: notification_type is deprecated in MSC4075 (ring in DMs, notify
elsewhere when omitted), _onRTCSessionMemberUpdate ->
ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the
7.8 MB crypto wasm.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/client/initMatrix.ts

@@ -3,8 +3,7 @@ import { createClient, MatrixClient, IndexedDBStore, IndexedDBCryptoStore } from
 import { cryptoCallbacks } from './secretStorageKeys';
 import { clearNavToActivePathStore } from '../app/state/navToActivePath';
 import { getFallbackSession, removeFallbackSession, Session } from '../app/state/sessions';
-import { LotusOidcTokenRefresher } from './oidcTokenRefresher';
-import { revokeOidcTokens } from './oidcLogout';
+import { installRefreshGuard, OidcIdentity, persistRefreshedTokens } from './oidcTokenRefresher';
 import { pushSessionToSW } from '../sw-session';
 import { deleteSearchCacheDatabase, shouldRunBootCleanup } from '../app/utils/searchCache';
 import { clearPlaintextCaches } from '../app/state/plaintextCaches';
@@ -62,12 +61,19 @@ export const initClient = async (session: Session): Promise<MatrixClient> => {
 
   const legacyCryptoStore = new IndexedDBCryptoStore(globalThis.indexedDB, 'crypto-store');
 
-  // OIDC/next-gen-auth sessions carry a refresh token; wire automatic refresh
-  // (the client calls this reactively on a 401) and persist rotated tokens.
-  const oidcRefresher =
+  // OIDC/next-gen-auth sessions carry a refresh token. Since SDK 43 the client
+  // refreshes them itself; we persist the rotated tokens and serialise
+  // refreshes across tabs (oidcTokenRefresher).
+  const oidcIdentity: OidcIdentity | undefined =
     session.refreshToken && session.oidc
-      ? new LotusOidcTokenRefresher(session.oidc, session.deviceId, session.userId, session.baseUrl)
+      ? {
+          userId: session.userId,
+          deviceId: session.deviceId,
+          baseUrl: session.baseUrl,
+          oidc: session.oidc,
+        }
       : undefined;
+  if (oidcIdentity) installRefreshGuard(oidcIdentity);
 
   const mx = createClient({
     baseUrl: session.baseUrl,
@@ -84,8 +90,9 @@ export const initClient = async (session: Session): Promise<MatrixClient> => {
     cryptoCallbacks: cryptoCallbacks as any,
     // SAS (emoji) + QR-code verification (show/scan/reciprocate).
     verificationMethods: ['m.sas.v1', 'm.qr_code.show.v1', 'm.qr_code.scan.v1', 'm.reciprocate.v1'],
-    tokenRefreshFunction: oidcRefresher
-      ? (refreshToken) => oidcRefresher.doRefreshAccessToken(refreshToken)
+    oauthClientId: oidcIdentity?.oidc.clientId,
+    onTokenRefresh: oidcIdentity
+      ? (tokens) => persistRefreshedTokens(oidcIdentity, tokens)
       : undefined,
   });
 
@@ -130,11 +137,8 @@ export const clearCacheAndReload = async (mx: MatrixClient) => {
 export const logoutClient = async (mx: MatrixClient) => {
   pushSessionToSW();
   mx.stopClient();
-  // For OIDC sessions, revoke the tokens at the issuer too (best-effort).
-  const session = getFallbackSession();
-  if (session?.oidc) {
-    await revokeOidcTokens(session);
-  }
+  // For OIDC sessions the SDK revokes the tokens at the auth server instead of
+  // calling /logout (matrix-js-sdk 43+); best-effort either way.
   try {
     await mx.logout();
   } catch {