Add TURN/STUN server for audio/video calls.

Jingle A/V (XEP-0166/0167/0176) needs a STUN/TURN server for NAT
traversal. Add coturn and advertise it to clients via XEP-0215.

- coturn container, host networking (a relay needs its full UDP port
  range reachable, and Docker NAT hides the peer addresses coturn needs).
- mod_turn_external in Prosody to advertise the service and mint
  time-limited credentials from a shared secret.
- Advertise UDP and TCP transports plus turns: on 5349, so clients on
  UDP-blocking networks can still connect.
- Deny relaying to private ranges, so this is not an open proxy into
  internal services.

TURN host is guschin.info rather than turn.guschin.info because only the
former is in the certificate SANs and turns: clients validate the name.

TURN_HOST/TURN_SECRET go in .env, which is gitignored and set per
deployment; TURN_SECRET must match static-auth-secret in turnserver.conf.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

data/prosody/configuration/prosody.cfg.lua

@@ -31,6 +31,11 @@ modules_enabled = {
 	-- Gateway support
 	"privilege";
 	"http_file_share";
+
+	-- Audio/video calls (Jingle): advertise the TURN/STUN server to clients
+	-- via XEP-0215. Clients do the media themselves; Prosody only signals
+	-- and hands out time-limited TURN credentials.
+	"turn_external";
 };
 
 modules_disabled = {
@@ -76,6 +81,24 @@ archive_expires_after = "never"
 -- Certificates directory (global, before VirtualHost)
 certificates = "/etc/prosody/certs"
 
+-- TURN/STUN for audio/video calls (XEP-0215 External Service Discovery).
+-- mod_turn_external does not run a relay itself; it tells clients where the
+-- coturn instance is and issues short-lived credentials signed with the
+-- shared secret. turn_external_secret must equal static-auth-secret in
+-- coturn/turnserver.conf.
+--
+-- turn_external_host is guschin.info rather than turn.guschin.info because
+-- only the former is in the certificate SANs, and turns:// (TLS) clients
+-- validate the name against the cert.
+turn_external_host = os.getenv("TURN_HOST") or "guschin.info"
+turn_external_secret = os.getenv("TURN_SECRET")
+turn_external_port = 3478
+turn_external_tls_port = 5349
+turn_external_ttl = 86400
+-- Also advertise TCP transports, not just UDP: some restrictive networks
+-- block UDP entirely, and TCP/TLS on 5349 is the fallback that still works.
+turn_external_tcp = true
+
 -- Primary virtual host (user@guschin.info)
 VirtualHost "guschin.info"
     ssl = {