heather: install jitsi from scratch per official docs (minimal)

Per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
and official docker-compose.yml. Minimal config, no copying from old install.

- 4 services: web/prosody/jicofo/jvb (stable-11031, docker hub)
- read_only + tmpfs per official compose
- Named volumes: jitsi-{web,prosody,prosody-data,jicofo,jvb,transcripts}
- Network meet-jitsi, prosody alias xmpp.meet.jitsi
- Reverse proxy: DISABLE_HTTPS=1, Caddy v2 auto-WebSocket (no manual header_up)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Auth: internal (ENABLE_AUTH=1, AUTH_TYPE=internal). NO GUESTS — template bug
  in prosody: guest domain lacks websocket module → disconnect loop
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Firewall: 10000/udp (NixOS + YC SG)

hosts/heather/caddy.nix

@@ -73,6 +73,12 @@ in {
         encode zstd gzip
       '';
 
+      # Jitsi Meet (Caddy v2 auto-handles WebSocket upgrade)
+      # Docs: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-a-reverse-proxy
+      "jitsi.iscg.dev".extraConfig = ''
+        reverse_proxy 127.0.0.1:8000
+      '';
+
       # Teable
       "teable.iscg.dev".extraConfig = ''
         reverse_proxy 127.0.0.1:2345