heather: add coturn TURN relay for jitsi (clients behind symmetric NAT)

- coturn/coturn:4.7 in host network (real client IPs, NAT traversal)
- static-auth-secret shared with jitsi-web TURN_CREDENTIALS (in jitsi.env)
- RTP relay 49152-65535/udp, listening-port 3478
- realm turn.iscg.dev, external-ip 51.250.45.111
- no-tls/no-dtls (TLS on 5349 disabled, udp-only for now)
- jitsi-web env: TURN_HOST/PORT/TRANSPORT
- NixOS firewall: 3478 tcp+udp, 49152-65535/udp range
- YC SG already has 3478/5349/49152-65535 from initial setup

hosts/heather/default.nix

@@ -43,10 +43,16 @@
       22000   # syncthing sync
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
+      3478    # coturn TURN (tcp+udp)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)
       10000   # jitsi jvb (RTP media)
+      3478    # coturn TURN
+    ];
+    # coturn RTP relay range
+    firewall.allowedUDPPortRanges = [
+      { from = 49152; to = 65535; }  # coturn RTP relay
     ];
   };
   # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.