Deploy the puzzle relay alongside the container stack

Adds a puzzle-relay service (docker-compose.yml) running the same
image as php but executing app:puzzle-relay instead of php-fpm, kept
off the host network - only nginx can reach it. nginx proxies
wss://dmtools.fvandenberg.nl/puzzle-ws/ through to it
(docker/nginx/default.conf), with the public URL set via a new
.env.prod. setup.sh/restart.sh now rebuild, restart, and clean up the
new container alongside the existing ones.

Still needs "Websockets Support" enabled on the NPM proxy host for
this domain, or the upgrade headers never reach the container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -33,6 +33,21 @@ services:
         condition: service_healthy
     restart: unless-stopped
 
+  puzzle-relay:
+    build:
+      context: .
+      dockerfile: docker/php/Dockerfile
+    container_name: dmtools-puzzle-relay
+    command: ["php", "bin/console", "app:puzzle-relay"]
+    env_file:
+      - path: .env
+      - path: .env.local
+        required: false
+    volumes:
+      - .:/var/www/html:cached
+      - php_var:/var/www/html/var
+    restart: unless-stopped
+
   nginx:
     image: nginx:1.30-alpine
     container_name: dmtools-nginx
@@ -43,6 +58,7 @@ services:
       - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
     depends_on:
       - php
+      - puzzle-relay
     restart: unless-stopped
 
   database: