WebRTC notes

WebRTCConnection wraps a DataChannel. The default channel is reliable and ordered. SignalingService exchanges offers, answers, and ICE candidates over the existing WebSocket path; the relay does not carry the game state once a DataChannel is active.

Connection setup uses the configured STUN/TURN servers. On failure the hybrid manager retries once with TURN and then falls back to the WebSocket relay. TURN is a connectivity aid, not authentication. A production deployment should use authenticated, short-lived TURN credentials and TLS/WSS for signaling. The repository does not make authenticated TURN a default service or provide a complete production identity system.