Fix: Nakama chess modules, chat WebSocket protocol, and streaming SSL

- Add Nakama Dockerfile to build custom image with chess modules
- Update docker-compose.prod.yml to use custom Nakama image with --runtime.js_entrypoint
- Fix chat WebSocket to use wss:// on HTTPS pages (was hardcoded ws://)
- Add SSL configuration to nginx port 8088 for HLS/LLHLS streaming
- Add Nakama build step to CI workflow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/lib/chat/chatWebSocket.js

@@ -37,7 +37,9 @@ class ChatWebSocket {
 
 		// SECURITY FIX #9: Don't include token in URL query params
 		// Token will be sent as first message after connection to avoid logging/exposure
-		let wsUrl = `ws://${window.location.host}/chat/ws?realmId=${encodeURIComponent(realmId)}`;
+		// Use wss:// for HTTPS, ws:// for HTTP (dynamic protocol detection)
+		const wsProtocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+		let wsUrl = `${wsProtocol}//${window.location.host}/chat/ws?realmId=${encodeURIComponent(realmId)}`;
 
 		// Guest connection - generate fingerprint for ban enforcement
 		// Only guests are fingerprinted, registered users are NOT fingerprinted for privacy