Play cameras through the relay instead of straight at the gateway

The player posted its SDP offer to the gateway's go2rtc directly, which
cannot work from a browser on another origin: no CORS headers on any
go2rtc response, a preflight required because application/sdp is not
CORS-safelisted, and the password checked before CORS so that preflight
gets a 401. It now hands the offer to a `signal` function the app
supplies, which relays it through the backend.

Pinned to iceTransportPolicy "relay" whenever ICE servers are present,
so media always goes through the TURN relay and never peer-to-peer. A
hosted console cannot rely on reaching a customer's gateway directly,
and a camera that works from the workshop but not from home is worse
than one that behaves the same everywhere.

With no TURN configured it falls back to "all", which still works for a
viewer on the gateway's own network. Relay-only with no relay would
gather no candidates and fail every time, so the fallback is what makes
an unconfigured deployment degrade rather than break - and a failed
connection in that state now says so, since the browser reports nothing
but "failed" and the fix is a deployment setting.

It also waits for ICE gathering before signalling rather than trickling:
the answer comes back through a single request/response relay hop, so
there is no channel to trickle over afterwards and the offer has to
carry its candidates. Bounded at 3s, because gathering can hang on a
candidate that never resolves and signalling with what we have beats
waiting forever.

`signal` is a prop rather than a fetch in the component, like `stream`
already was: @continuum/ui stays plain Vue that knows nothing of the API,
which is what lets it render from a test or the desktop shell.

apps/web/pages/index.vue

@@ -31,6 +31,22 @@ function current(printer: AppPrinterState): AppPrinterState {
 // mean one request per machine in the fleet, most of them 404 by design.
 const streams = ref<Record<string, PrinterStream | null>>({});
 
+/**
+ * Relays one printer's WebRTC offer through the backend and returns the
+ * gateway's answer.
+ *
+ * Lives here rather than in `@continuum/ui` for the same reason the stream
+ * lookup does: that package is plain Vue that knows nothing of the API, so
+ * the app supplies the one function that talks to it.
+ */
+async function signalOffer(printerId: string, sdp: string): Promise<string> {
+  const answer = await apiFetch<{ sdp: string }>(`/printers/${printerId}/webrtc`, {
+    method: "POST",
+    body: { sdp },
+  });
+  return answer.sdp;
+}
+
 watch(
   printers,
   (list) => {
@@ -59,6 +75,7 @@ watch(
         :key="printer.id"
         :printer="current(printer)"
         :stream="streams[printer.id]"
+        :signal="(sdp: string) => signalOffer(printer.id, sdp)"
       />
     </div>
     <p v-if="!printers?.length">