Add TURN relay support for daemon mode

-turn-url and -turn-secret flags on the daemon; credentials generated
using coturn use-auth-secret HMAC-SHA1 scheme (same as browser mode).
ICEServers field on mesh.Mesh threads extra ICE servers through to
every PeerConnection created by the anchor client.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/mesh/mesh.go

@@ -13,6 +13,9 @@ import (
 	"github.com/waste-go/internal/store"
 )
 
+// ICEServer mirrors webrtc.ICEServer so callers don't import pion directly.
+type ICEServer = webrtc.ICEServer
+
 // PeerConn is a live connection to one peer.
 type PeerConn struct {
 	Info proto.PeerInfo
@@ -33,7 +36,8 @@ type Mesh struct {
 	InviteString  string // the invite this peer used to join (sent in hello to other peers)
 	// ScanFiles overrides ScanShareDir when set — allows the manager to inject
 	// multi-share scanning without the mesh needing to know about shares.json.
-	ScanFiles func() []proto.FileEntry
+	ScanFiles  func() []proto.FileEntry
+	ICEServers []ICEServer // extra ICE servers (e.g. TURN); appended to the default STUN entry
 
 	mu    sync.RWMutex
 	peers map[proto.PeerID]*PeerConn