WebRTC TURN Preparation

Current repo truth

• durable call-session state remains in svc-messaging
• signaling remains on the existing websocket channel
• browser WebRTC peers now resolve ICE config from web env instead of ad hoc literals
• TURN remains optional for local development; STUN-only fallback still works

Environment contract

Frontend:

• NEXT_PUBLIC_WEBRTC_STUN_URLS
• NEXT_PUBLIC_WEBRTC_TURN_URLS
• NEXT_PUBLIC_WEBRTC_TURN_USERNAME
• NEXT_PUBLIC_WEBRTC_TURN_CREDENTIAL
• NEXT_PUBLIC_WEBRTC_ICE_TRANSPORT_POLICY

Backend / deploy placeholders:

• WEBRTC_STUN_URLS
• WEBRTC_TURN_URLS
• WEBRTC_TURN_USERNAME
• WEBRTC_TURN_CREDENTIAL
• WEBRTC_ICE_TRANSPORT_POLICY

Local verification

• with only NEXT_PUBLIC_WEBRTC_STUN_URLS, calling should behave exactly like the current localhost flow
• with TURN vars also populated, the peer connection should include both STUN and TURN ICE servers
• NEXT_PUBLIC_WEBRTC_ICE_TRANSPORT_POLICY=relay can be used to smoke-test TURN-only routing

What this pass does not do

• no TURN credential minting service
• no coturn observability stack
• no Twilio / PSTN / external telephony
• no signaling architecture rewrite