Wire a configurable TURN server into the WebRTC mesh

## Problem

`PeerMesh` (`apps/web/lib/peer-mesh.ts`) already accepts an `iceServers` override in its constructor, but nothing in `apps/web` currently reads a real TURN configuration and passes it through. Every session today uses the hardcoded public STUN default, which works on most networks but fails outright on symmetric NATs or locked-down corporate firewalls where a direct peer-to-peer connection can never be established.

## Proposed solution

- Add a `NEXT_PUBLIC_ICE_SERVERS` (or similar) environment variable — already stubbed as a build arg in `apps/web/Dockerfile` but unused — carrying a JSON-encoded ICE server list.
- Parse it in `room-workspace.tsx` and pass it into `new PeerMesh({ iceServers, ... })` instead of relying on the class default.
- Document the expected JSON shape and a couple of TURN provider examples (Cloudflare Calls, Twilio, a self-hosted coturn) in `docs/deployment.md`.
- Verify with a real two-participant session on a network where direct P2P is blocked (e.g. a corporate VPN or a mobile hotspot with symmetric NAT) — the roadmap explicitly calls out that this hasn't been exercised yet.

## References

- [`docs/roadmap.md`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/roadmap.md) — "TURN isn't wired up"
- [`docs/realtime.md#known-limitations`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/realtime.md)