Public rooms directory

Our slice of the federation public-rooms directory: the rooms we have crawled and indexed. Authenticated federation endpoint, so a missing or invalid X-Matrix signature is a 401. GET (query params) and POST (JSON filter body) share one handler, and a malformed POST body is logged then ignored, so you get the unfiltered listing rather than an error.