Fix: Nakama chess modules, chat WebSocket protocol, and streaming SSL

- Add Nakama Dockerfile to build custom image with chess modules
- Update docker-compose.prod.yml to use custom Nakama image with --runtime.js_entrypoint
- Fix chat WebSocket to use wss:// on HTTPS pages (was hardcoded ws://)
- Add SSL configuration to nginx port 8088 for HLS/LLHLS streaming
- Add Nakama build step to CI workflow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

openresty/nginx.conf

@@ -820,10 +820,17 @@ http {
         }
     }
     
-    # Separate server block for port 8088 (HLS/LLHLS)
+    # Separate server block for port 8088 (HLS/LLHLS) - with SSL for production
     server {
-        listen 8088;
-        server_name localhost;
+        listen 8088 ssl http2;
+        server_name beeta.realms.pub;
+
+        # SSL certificates (same as main server block)
+        ssl_certificate /etc/letsencrypt/live/beeta.realms.pub/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/beeta.realms.pub/privkey.pem;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
 
         # Site-wide uberban check - blocks banned fingerprints from streaming
         access_by_lua_block {