fix(sfu): use TCP TURN relay, not UDP, so multi-homed hosts don't drop

A UDP TURN relay rides UDP between the client and the TURN server, which
NAT-rebinds and silently dies a couple minutes into a stream on a
multi-homed / dead-NIC host. With "Force relay" (relay-only) there's no
fallback, so the publisher fails with "could not establish pc
connection" — even though the relay connected fine initially. Append
?transport=tcp to plain turn: URLs so the client→TURN leg is a stable
TCP connection (coturn listens TCP on 3478; verified solid). turns:
(TLS) is left as a last-resort fallback only — its handshake is
intermittently flaky on this coturn. Server-side, so existing clients
pick it up on the next connect (no app release).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

apps/web/src/lib/ice-servers.ts

@@ -17,14 +17,26 @@ export function getIceServers(): IceServer[] {
   const username = process.env.TURN_SERVER_USERNAME ?? process.env.NEXT_PUBLIC_TURN_USERNAME;
   const credential = process.env.TURN_SERVER_CREDENTIAL ?? process.env.NEXT_PUBLIC_TURN_CREDENTIAL;
 
-  // Prefer TURNS (TLS/443-style) first — it tunnels over TCP and survives the
-  // NAT rebinding / multi-homing that kills plain UDP. Then UDP TURN, then a
-  // raw-IP fallback for when DNS is the problem.
+  // Force TCP transport on plain turn: URLs. A UDP TURN relay still rides UDP
+  // between the client and the TURN server, so on a multi-homed / dead-NIC host
+  // it NAT-rebinds and silently drops a minute or two into a stream — and with
+  // "Force relay" (relay-only) there is no fallback candidate, so the publisher
+  // dies with "could not establish pc connection". A TCP relay survives the
+  // rebind. coturn listens TCP on 3478 and the TCP relay path is solid (the
+  // TLS :5349 path is intermittently flaky, so we keep turns: only as a last
+  // resort). turns: already rides TCP, so leave it untouched.
+  const toTcp = (u: string): string =>
+    u.startsWith('turns:') || u.includes('transport=')
+      ? u
+      : `${u}${u.includes('?') ? '&' : '?'}transport=tcp`;
+
   const turnUrls = [
     process.env.NEXT_PUBLIC_TURNS_URL,
     process.env.TURN_SERVER_URL ?? process.env.NEXT_PUBLIC_TURN_URL,
     process.env.TURN_SERVER_IP_URL ?? process.env.NEXT_PUBLIC_TURN_IP_URL,
-  ].filter((u): u is string => Boolean(u));
+  ]
+    .filter((u): u is string => Boolean(u))
+    .map(toTcp);
 
   if (turnUrls.length > 0 && username && credential) {
     servers.push({ urls: turnUrls, username, credential });