Deploy the puzzle relay alongside the container stack

Adds a puzzle-relay service (docker-compose.yml) running the same
image as php but executing app:puzzle-relay instead of php-fpm, kept
off the host network - only nginx can reach it. nginx proxies
wss://dmtools.fvandenberg.nl/puzzle-ws/ through to it
(docker/nginx/default.conf), with the public URL set via a new
.env.prod. setup.sh/restart.sh now rebuild, restart, and clean up the
new container alongside the existing ones.

Still needs "Websockets Support" enabled on the NPM proxy host for
this domain, or the upgrade headers never reach the container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/setup.sh

@@ -65,7 +65,7 @@ fi
 
 # docker-compose v1 can choke recreating a container in place on any config
 # change; removing them first sidesteps that. Safe: state lives in named volumes.
-dc rm -fs php nginx database 2>/dev/null || true
+dc rm -fs php puzzle-relay nginx database 2>/dev/null || true
 
 BUILD_ARGS=()
 [ "$REBUILD" -eq 1 ] && BUILD_ARGS+=("--build")
@@ -97,7 +97,7 @@ if grep -q '^APP_SECRET=$' "$ROOT_DIR/.env" 2>/dev/null \
    && ! grep -q '^APP_SECRET=' "$ROOT_DIR/.env.local" 2>/dev/null; then
   echo "Generating APP_SECRET in .env.local..."
   printf 'APP_SECRET=%s\n' "$(openssl rand -hex 16)" >> "$ROOT_DIR/.env.local"
-  dc up -d php   # pick up the new env value
+  dc up -d php puzzle-relay   # pick up the new env value
 fi
 
 echo "Creating database if it doesn't exist..."
@@ -116,8 +116,10 @@ pexec chown -R www-data:www-data var
 
 # php.ini sets opcache.validate_timestamps=0, so php-fpm keeps serving the
 # old compiled code/templates until it restarts. Bounce it so a --no-build
-# run (git pull + this script) actually picks up the new cache.
-dc restart php
+# run (git pull + this script) actually picks up the new cache. puzzle-relay
+# is a single long-running process, not php-fpm workers, but it's exactly as
+# stale otherwise: it keeps running whatever code was loaded when it started.
+dc restart php puzzle-relay
 
 # Make sure Nginx Proxy Manager can reach this stack's nginx by name.
 # Harmless (and a no-op) if already connected; NPM keeps it across restarts.