Document TURN certificate renewal hook.

coturn stages the cert at start, so a renewal needs a container restart.
Record that the certbot deploy hook (which lives outside this repo) now
restarts coturn alongside prosody-xmpp.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -132,6 +132,21 @@ audio/video include Conversations (Android), Dino, Gajim, and Monal (iOS).
 Note that Jingle A/V is client-to-client — both parties need a client that
 supports it.
 
+### Certificate renewal
+
+`coturn/entrypoint.sh` copies the certificate at container start, because
+coturn runs as `nobody` and cannot read Let's Encrypt's root-only
+`privkey.pem` directly. A renewal therefore needs a container restart, which
+the certbot deploy hook on the server handles (outside this repo):
+
+```
+/etc/letsencrypt/renewal-hooks/deploy/restart-prosody.sh
+```
+
+It restarts both `prosody-xmpp` and `coturn` when the `guschin.info` or
+`xmpp.guschin.info` lineage is renewed. Without the coturn restart, `turns:`
+on 5349 would keep serving the old certificate until the next restart.
+
 ### Firewall
 
 Ports 3478 and 5349 (both UDP and TCP) plus the UDP relay range 49160-49200