heather: install jitsi meet from scratch (web/prosody/jicofo/jvb)

Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)

hosts/heather/default.nix

@@ -43,9 +43,12 @@
       22000   # syncthing sync
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
+      # jitsi: 3478/5349 (turn, когда добавим coturn)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)
+      10000   # jitsi jvb (RTP media)
+      # jitsi: 49152-65535 (RTP range, когда добавим coturn через allowedUDPPortRanges)
     ];
   };
   # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.