improve WebRTC NAT reliability diagnostics

README.md

@@ -28,6 +28,7 @@ PORT=8081 npm start
 | `STUN_URLS` | comma-separated `stun:` urls (Google defaults) |
 | `TURN_URLS` | comma-separated `turn:`/`turns:` urls |
 | `TURN_USERNAME` / `TURN_CREDENTIAL` | static TURN creds |
+| `ICE_TRANSPORT_POLICY` | WebRTC ICE policy: `all`, `relay`, or `none` |
 | `ICE_SERVERS_JSON` | full `{"iceServers":[...]}` override, wins over the above |
 | `PORT` / `HOST` | listen address (default 8081 / 0.0.0.0) |
 
@@ -38,6 +39,10 @@ TURN_URLS='turn:turn.example.com:3478?transport=udp,turns:turn.example.com:5349'
 TURN_USERNAME=mats TURN_CREDENTIAL=secret npm start
 ```
 
+For deployments where clients are commonly behind separate NATs, set
+`ICE_TRANSPORT_POLICY=relay` so media consistently uses the public TURN
+service instead of depending on NAT hairpinning or direct candidate pairs.
+
 ## POC shortcuts (productionize later)
 
 - No auth, no reconnection, rooms are in-memory, signaling is unencrypted ws