fix(livekit): single UDP media port + pin node_ip for the NAT'd server

The prod box is behind NAT (private 192.168.88.61 behind public 118.95.33.89), so
LiveKit auto-IP-detection would pick the wrong (outbound) address. Pin
rtc.node_ip=118.95.33.89 and collapse media to one UDP port (50000) + TCP 7881 to
minimize the upstream gateway port-forward the network team must add. Docs updated
with the exact forward table.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

livekit.yaml

@@ -7,10 +7,12 @@
 port: 7880                     # signaling (HTTP/WS) — NPM proxies wss://livekit.bizgaze.com -> here
 rtc:
   tcp_port: 7881               # WebRTC-over-TCP fallback (restrictive networks)
-  port_range_start: 50000      # WebRTC media (UDP) — keep in sync with the published range in compose
-  port_range_end: 50100
-  use_external_ip: true        # discover the public IP for ICE candidates (VPS). Or set node_ip below.
-  # node_ip: 118.95.33.89      # uncomment + set if use_external_ip can't detect the public IP
+  udp_port: 50000              # SINGLE UDP media port (all participants mux over it) — minimizes
+                               # the NAT port-forward to one UDP + one TCP port.
+  # This box sits behind NAT (private 192.168.88.61 behind public 118.95.33.89). Auto-detection
+  # would find the wrong (outbound) IP, so pin the inbound public IP clients actually reach.
+  use_external_ip: false
+  node_ip: 118.95.33.89
 
 # Embedded TURN over TLS on 443 helps clients on locked-down networks. Left off by default because
 # NPM already owns 443; enable via a dedicated hostname + NPM stream if you need it (see DEPLOY.md).