improvement: only remove to-device events when sure the client received them

To make this work, I had to remove the recommended limit of 100
to-device events per /sync
(https://matrix.org/docs/spec/client_server/latest#id72)