Add TURN relay support and document coturn setup

Browser adapter reads turnURL + turnSecret from WASTE_CONFIG and adds a
TURN ICEServer entry automatically. Uses time-limited credentials
compatible with coturn's use-auth-secret mode.

README: new section under Hosting with coturn install, turnserver.conf,
firewall note (UDP 3478, no NPM needed), and config.js snippet.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/adapter/browser.ts

@@ -16,6 +16,17 @@ const EKEY_PREFIX = 'yaw/2.1 ekey'
 const FS_TIMEOUT = 2000
 const STUN = 'stun:stun.l.google.com:19302'
 
+function iceServers(): RTCIceServer[] {
+  const cfg = (window as unknown as { WASTE_CONFIG?: { turnURL?: string; turnSecret?: string } }).WASTE_CONFIG
+  const servers: RTCIceServer[] = [{ urls: STUN }]
+  if (cfg?.turnURL && cfg?.turnSecret) {
+    // TURN with time-limited credentials derived from static-auth-secret
+    const user = Math.floor(Date.now() / 1000) + 3600 + ':waste'
+    servers.push({ urls: cfg.turnURL, username: user, credential: cfg.turnSecret })
+  }
+  return servers
+}
+
 const enc = (s: string) => new TextEncoder().encode(s)
 
 function concat(...arrs: Uint8Array[]): Uint8Array {
@@ -263,7 +274,7 @@ class PeerConn {
     this.on = on
     this.nick = nick
     this.share = share
-    this.pc = new RTCPeerConnection({ iceServers: [{ urls: STUN }] })
+    this.pc = new RTCPeerConnection({ iceServers: iceServers() })
     const kp = sodium.crypto_box_keypair()
     this._esk = kp.privateKey
     this._epk = kp.publicKey