fix(deploy): 404 missing assets instead of HTML fallback; ship public STUN config

- nginx: asset extensions use try_files $uri =404 so a missing file (e.g.
  config/ice-servers.js) no longer serves index.html with the wrong content type
- add config/ice-servers.prod.js (public STUN, no secrets); Dockerfile copies it
  to the git-ignored config/ice-servers.js so the operator-override path exists

deploy/nginx.conf

@@ -58,7 +58,14 @@ http {
         add_header Cache-Control            $sb_cache                          always;
         add_header Service-Worker-Allowed   "/"                                always;
 
-        # SPA-style fallback so unknown routes still load the app shell.
+        # Real asset files must return 404 when missing — never fall back to the
+        # HTML shell, which would be served with the wrong content type and break
+        # module/script loading (e.g. a missing config/ice-servers.js).
+        location ~* \.(js|mjs|jsx|css|json|map|woff2?|ttf|otf|png|jpe?g|gif|webp|svg|ico|mp3|mp4|webm)$ {
+            try_files $uri =404;
+        }
+
+        # SPA-style fallback so unknown navigation routes still load the app shell.
         location / {
             try_files $uri $uri/ /index.html;
         }