Fix: Nakama chess modules, chat WebSocket protocol, and streaming SSL

- Add Nakama Dockerfile to build custom image with chess modules
- Update docker-compose.prod.yml to use custom Nakama image with --runtime.js_entrypoint
- Fix chat WebSocket to use wss:// on HTTPS pages (was hardcoded ws://)
- Add SSL configuration to nginx port 8088 for HLS/LLHLS streaming
- Add Nakama build step to CI workflow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -116,7 +116,7 @@ services:
       - backend
 
   nakama:
-    image: registry.heroiclabs.com/heroiclabs/nakama:3.21.1
+    image: qbit.realms.pub/doomtube/beeta/nakama:latest
     restart: unless-stopped
     depends_on:
       postgres:
@@ -134,6 +134,7 @@ services:
           --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable" \
           --socket.server_key "$NAKAMA_SERVER_KEY" \
           --session.token_expiry_sec 86400 \
+          --runtime.js_entrypoint "main.js" \
           --runtime.env "JWT_SECRET=$JWT_SECRET" \
           --console.username admin \
           --console.password "$NAKAMA_CONSOLE_PASSWORD" \
@@ -143,7 +144,6 @@ services:
       - NAKAMA_CONSOLE_PASSWORD=${NAKAMA_CONSOLE_PASSWORD}
       - NAKAMA_SERVER_KEY=${NAKAMA_SERVER_KEY}
       - DB_PASSWORD=${DB_PASSWORD}
-    # Custom modules can be baked into a custom nakama image if needed
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:7350/healthcheck"]
       interval: 10s