fix: LiveKit voice connection for remote clients behind reverse proxy

- Fix race condition: handleDisconnected no longer nulls the room during
  initial connect, allowing the retry loop to complete all 3 attempts
- Fix TLS proxy port: default to 443 instead of 8443 when server host
  has no explicit port (servers behind nginx/reverse proxy)
- Fix cert store key: strip :443 suffix so LiveKit proxy fingerprint
  lookup matches ws_proxy's stored key format
- Add node_ip config option for LiveKit WebRTC ICE candidates (required
  for remote users behind NAT)
- Add resolved URL to all connection error/retry/reconnect logs for
  easier debugging
- Add diagnostic logging to resolveLiveKitUrl showing which path was
  taken (direct/proxy/passthrough)

Server/config/config.go

@@ -38,6 +38,7 @@ type VoiceConfig struct {
 	LiveKitAPISecret string `koanf:"livekit_api_secret"` // LiveKit API secret
 	LiveKitURL       string `koanf:"livekit_url"`        // LiveKit server WebSocket URL (e.g. ws://localhost:7880)
 	LiveKitBinaryPath string `koanf:"livekit_binary"`    // path to livekit-server binary; empty = don't auto-start
+	NodeIP           string `koanf:"node_ip"`            // public IP for WebRTC ICE candidates; empty = auto-detect
 	Quality          string `koanf:"quality"`            // low | medium | high
 }
 
@@ -144,6 +145,7 @@ voice:
   # livekit_api_secret: ""    # LiveKit API secret (REQUIRED, min 32 chars — generate a unique secret)
   livekit_url: "ws://localhost:7880"  # LiveKit server WebSocket URL
   # livekit_binary: ""             # path to livekit-server binary; empty = don't auto-start
+  # node_ip: ""                    # public IP for WebRTC media (required for remote users behind NAT)
   # quality: "medium"              # low | medium | high
 
 # github: