heather: enable jitsi meet stack (jitsi.iscg.dev)

Стек: web + prosody + jicofo + jvb + coturn. Перенесено с jul11 (2026-07-12):
- config (web/prosody/jicofo/jvb) → named volumes heather_jitsi-{web,prosody,jicofo,jvb,transcripts}
- prosody user mikl.dat сохранён (internal auth)
- образ PIN: stable-11031 (как на jul11, НЕ :latest)
- пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
- env-файл /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
- coturn в host network (real client IPs), realm=turn.iscg.dev
- JVB 10000/udp публично (YC SG уже ANY ANY open)
- Caddy: WebSocket routes /xmpp-websocket, /colibri-ws (hop-by-hop upgrade)
- DISABLE_HTTPS=1 (Caddy терминирует TLS)

hosts/heather/caddy.nix

@@ -73,8 +73,22 @@ in {
         encode zstd gzip
       '';
 
-      # Jitsi Meet
+      # Jitsi Meet (web + WebSocket routes)
       "jitsi.iscg.dev".extraConfig = ''
+        # WebSocket routes — hop-by-hop, требуют явного upgrade
+        @xmpp path /xmpp-websocket*
+        reverse_proxy @xmpp 127.0.0.1:8000 {
+          header_up Host {host}
+          header_up Upgrade {http.upgrade}
+          header_up Connection {http.connection}
+        }
+        @colibri path /colibri-ws*
+        reverse_proxy @colibri 127.0.0.1:8000 {
+          header_up Host {host}
+          header_up Upgrade {http.upgrade}
+          header_up Connection {http.connection}
+        }
+        # Остальное → web контейнер
         reverse_proxy 127.0.0.1:8000
         encode zstd gzip
       '';