Fix: Nakama chess modules, chat WebSocket protocol, and streaming SSL

- Add Nakama Dockerfile to build custom image with chess modules
- Update docker-compose.prod.yml to use custom Nakama image with --runtime.js_entrypoint
- Fix chat WebSocket to use wss:// on HTTPS pages (was hardcoded ws://)
- Add SSL configuration to nginx port 8088 for HLS/LLHLS streaming
- Add Nakama build step to CI workflow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

nakama/Dockerfile

@@ -0,0 +1,36 @@
+# =============================================================================
+# Nakama with Custom Chess Modules
+# =============================================================================
+# Two-stage build:
+#   1. Build TypeScript modules with Node.js
+#   2. Copy compiled JS to Nakama runtime
+# =============================================================================
+
+# Stage 1: Build TypeScript modules
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Copy module files
+COPY modules/package*.json ./
+RUN npm ci
+
+# Copy source and build
+COPY modules/tsconfig.json ./
+COPY modules/src ./src
+
+# Build with esbuild (output to build/index.js)
+RUN npm run build
+
+# Verify build output exists
+RUN ls -la build/ && test -f build/index.js
+
+# Stage 2: Nakama runtime with modules
+FROM registry.heroiclabs.com/heroiclabs/nakama:3.21.1
+
+# Copy compiled JavaScript modules
+# Nakama expects modules at /nakama/data/modules/
+COPY --from=builder /app/build/index.js /nakama/data/modules/main.js
+
+# Copy config file (optional - can also be passed via CLI)
+COPY config.yml /nakama/data/config.yml