fix(sfu): stop offering the broken TLS TURN relay; keep working TCP relay

coturn's TLS listener (:5349) is broken on this box — clients' TLS relay
allocations fail with "TLS/TCP socket buffer operation error" / OpenSSL-3
"SSL routines internal error". Those failing candidates churn ICE and
delay the publisher until livekit hits a dtls timeout ("could not
establish pc connection"), even though a plain-TCP relay (3478/tcp)
carries media fine — verified in coturn logs (~830 KB relayed up to the
SFU on a working session). Drop the turns: URL from the offered ICE
servers; clients now use the TCP relay only. Server-side, applies on the
next connect (no app release). Re-add turns: once coturn TLS is fixed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

apps/web/src/lib/ice-servers.ts

@@ -30,8 +30,14 @@ export function getIceServers(): IceServer[] {
       ? u
       : `${u}${u.includes('?') ? '&' : '?'}transport=tcp`;
 
+  // NOTE: the turns: (TLS :5349) URL is intentionally NOT offered. coturn's
+  // TLS handshake is broken on this box (OpenSSL-3 "SSL routines internal
+  // error" / "TLS/TCP socket buffer operation error") — clients allocate TLS
+  // relay candidates that fail and churn, delaying ICE until livekit's
+  // publisher hits a dtls timeout, even though a plain-TCP relay carries media
+  // fine (verified: ~830 KB relayed over a 3478/tcp session). Offer only the
+  // TCP relay until coturn TLS is fixed.
   const turnUrls = [
-    process.env.NEXT_PUBLIC_TURNS_URL,
     process.env.TURN_SERVER_URL ?? process.env.NEXT_PUBLIC_TURN_URL,
     process.env.TURN_SERVER_IP_URL ?? process.env.NEXT_PUBLIC_TURN_IP_URL,
   ]