fix: WHIP browser-publish silently never sends media behind Cloudflare

MTX_WEBRTCADDITIONALHOSTS (the ICE host candidate MediaMTX advertises
for WebRTC/WHIP) was wired to PUBLIC_HOST, the Cloudflare-proxied
domain. The WHIP HTTP handshake (SDP offer/answer through nginx) still
succeeds through Cloudflare, so 'stream from this browser' looks like
it works — but the actual media is a raw UDP path (port 8189) that
Cloudflare never forwards regardless of port, same as the earlier RTMP
issue. The browser ends up trying to send video/audio to Cloudflare's
edge, which drops it, so nothing ever actually arrives.

Split into a dedicated MEDIAMTX_WEBRTC_HOST env var (raw origin IP in
production) instead of reusing PUBLIC_HOST, mirroring how
MEDIAMTX_RTMP_PUBLIC already does this for the same reason. Confirmed
via podman inspect that the previously-deployed container really was
resolving MTX_WEBRTCADDITIONALHOSTS to the Cloudflare-proxied hostname
before this fix.

.env.example

@@ -10,6 +10,14 @@ MEDIAMTX_WHIP_PUBLIC=http://${PUBLIC_HOST}:8889
 MEDIAMTX_HLS_PUBLIC=http://${PUBLIC_HOST}:8890
 BLOSSOM_URL_DEFAULT=http://${PUBLIC_HOST}:8098
 
+# ICE host candidate MediaMTX advertises for WebRTC/WHIP (browser-publish
+# "stream from this browser"). If you're behind Cloudflare or similar
+# HTTP(S)-only proxy, this MUST be the raw origin IP, not PUBLIC_HOST —
+# Cloudflare never forwards raw UDP, so a proxied hostname here makes the
+# WHIP handshake succeed while media silently never arrives. Same reasoning
+# as MEDIAMTX_RTMP_PUBLIC above. Plain host/IP, no scheme or port.
+MEDIAMTX_WEBRTC_HOST=${PUBLIC_HOST}
+
 # Default nostr relays for NIP-53 live-event announcements (comma separated,
 # changeable at runtime in Settings)
 NOSTR_RELAYS=wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band