Replace free TURN with self-hosted coturn; fix Safari connectivity; release v5.4.10

- config/ice-servers.prod.js: swap ExpressTURN for self-hosted coturn at
  turn.securebit.chat (TURN udp/tcp on 3478, TURNS/TLS on 443). Long-lived
  REST-API credential (expiry capped at int32 max for coturn compatibility).
- Add raw-IP STUN/TURN fallback (144.172.96.126): Safari's WebRTC layer fails
  to resolve STUN/TURN hostnames on some networks and gathers no srflx/relay
  candidates; reaching the server by IP fixes cross-browser (Safari<->Chrome)
  connections. Harmless to other browsers.
- deploy/nginx.conf: never long-cache /config/ice-servers.js so clients don't
  lock onto a stale server list.
- Bump version to 5.4.10 (header + init banner).

deploy/nginx.conf

@@ -45,6 +45,9 @@ http {
         ~^/sw\.js$               "no-cache, no-store, must-revalidate";
         ~^/manifest\.json$       "no-cache, no-store, must-revalidate";
         ~^/meta\.json$           "no-cache, no-store, must-revalidate";
+        # Operator ICE/TURN config: must never be cached long, or the browser
+        # locks onto a stale server list (default was max-age=1y immutable).
+        ~^/config/ice-servers\.js$ "no-cache, no-store, must-revalidate";
         # dist/ bundles are query-versioned (?v=) in index.html. "no-cache" forces
         # revalidation on every load, but dropping "no-store" lets the browser reuse
         # the cached copy on a 304 — avoiding a full re-download of the large bundles
@@ -66,6 +69,7 @@ http {
         ~^/sw\.js$               "no-store";
         ~^/manifest\.json$       "no-store";
         ~^/meta\.json$           "no-store";
+        ~^/config/ice-servers\.js$ "no-store";
         ~^/dist/                 "no-store";
     }