fix: WHIP browser-publish silently never sends media behind Cloudflare

MTX_WEBRTCADDITIONALHOSTS (the ICE host candidate MediaMTX advertises
for WebRTC/WHIP) was wired to PUBLIC_HOST, the Cloudflare-proxied
domain. The WHIP HTTP handshake (SDP offer/answer through nginx) still
succeeds through Cloudflare, so 'stream from this browser' looks like
it works — but the actual media is a raw UDP path (port 8189) that
Cloudflare never forwards regardless of port, same as the earlier RTMP
issue. The browser ends up trying to send video/audio to Cloudflare's
edge, which drops it, so nothing ever actually arrives.

Split into a dedicated MEDIAMTX_WEBRTC_HOST env var (raw origin IP in
production) instead of reusing PUBLIC_HOST, mirroring how
MEDIAMTX_RTMP_PUBLIC already does this for the same reason. Confirmed
via podman inspect that the previously-deployed container really was
resolving MTX_WEBRTCADDITIONALHOSTS to the Cloudflare-proxied hostname
before this fix.

docker-compose.yml

@@ -44,8 +44,16 @@ services:
       - "8189:8189/udp"    # WebRTC ICE
       - "8890:8888"        # HLS (host 8890; 8888 kept free for other apps)
     environment:
-      # Browsers need a reachable ICE host candidate; set PUBLIC_HOST in .env
-      MTX_WEBRTCADDITIONALHOSTS: ${PUBLIC_HOST:-localhost}
+      # Browsers need a reachable ICE host candidate for the actual UDP media
+      # path (browser-publish "stream from this browser" / WHIP). This must
+      # be the raw origin IP, NOT PUBLIC_HOST — Cloudflare's proxy only
+      # forwards HTTP(S), never raw UDP, regardless of port (same reason
+      # MEDIAMTX_RTMP_PUBLIC above uses the raw IP instead of the
+      # Cloudflare-proxied domain). Using PUBLIC_HOST here means the browser
+      # resolves the ICE candidate to Cloudflare's edge and the WHIP HTTP
+      # handshake succeeds while media silently never arrives — set
+      # MEDIAMTX_WEBRTC_HOST in .env.
+      MTX_WEBRTCADDITIONALHOSTS: ${MEDIAMTX_WEBRTC_HOST:-localhost}
     volumes:
       - ./mediamtx/mediamtx.yml:/mediamtx.yml:ro
       - mediamtx-recordings:/recordings