heather: install jitsi meet from scratch (web/prosody/jicofo/jvb)

Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)

hosts/heather/caddy.nix

@@ -73,6 +73,27 @@ in {
         encode zstd gzip
       '';
 
+      # Jitsi Meet (web + WebSocket routes)
+      # Доки: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-a-reverse-proxy
+      # WebSocket routes (/xmpp-websocket, /colibri-ws) — hop-by-hop, требуют
+      # явного Upgrade/Connection. Остальное → web контейнер на 127.0.0.1:8000.
+      "jitsi.iscg.dev".extraConfig = ''
+        @xmpp path /xmpp-websocket*
+        reverse_proxy @xmpp 127.0.0.1:8000 {
+          header_up Host {host}
+          header_up Upgrade {http.upgrade}
+          header_up Connection {http.connection}
+        }
+        @colibri path /colibri-ws*
+        reverse_proxy @colibri 127.0.0.1:8000 {
+          header_up Host {host}
+          header_up Upgrade {http.upgrade}
+          header_up Connection {http.connection}
+        }
+        reverse_proxy 127.0.0.1:8000
+        encode zstd gzip
+      '';
+
       # Teable
       "teable.iscg.dev".extraConfig = ''
         reverse_proxy 127.0.0.1:2345