Fix coturn TLS listeners and pin relay to public IP.

Two problems found once coturn was running:

TLS listeners never started. The live/ certificate files are relative
symlinks into ../../archive/, so mounting live/ alone left them dangling
and coturn silently fell back to no TLS, disabling turns: on 5349.
Prosody's identical mount works only because its entrypoint copies the
files; coturn reads them in place. Mount both trees at their real paths
and reference the cert through live/.

Relay used every interface. Without explicit addresses coturn discovered
all of them and offered relay candidates on the Docker bridges and
loopback -- unreachable for remote peers, and needless exposure of the
internal networks. Pin listening-ip and relay-ip to the public address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -69,7 +69,11 @@ services:
     network_mode: host
     volumes:
       - ./coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
-      - /etc/letsencrypt/live/guschin.info:/etc/coturn/certs:ro
+      # The live/ files are relative symlinks into ../../archive/, so both
+      # trees must be mounted at their real paths for the links to resolve.
+      # coturn reads the certificate directly (unlike Prosody, whose
+      # entrypoint copies it), so a broken symlink silently disables TLS.
+      - /etc/letsencrypt/live/guschin.info:/etc/letsencrypt/live/guschin.info:ro
       - /etc/letsencrypt/archive/guschin.info:/etc/letsencrypt/archive/guschin.info:ro
     command: ["-c", "/etc/coturn/turnserver.conf"]
     restart: unless-stopped