fix: improve TURN relay failover

[mrddt-tech]

Problem

Workers converged on the first TURN URL. A relay that accepted Allocate but returned no peer traffic could delay configuration and make healthy relays underused.

Root cause

Relay selection was first-available rather than per-worker, retries did not rotate relays, and concurrent Allocate calls could burst across groups. A credential refresh path also attempted to reacquire its own lock.

Implementation

• Assign TURN URLs deterministically round-robin; skip banned URLs and rotate after relay failures.
• Limit initial configuration acquisition to three relay-diverse racers.
• Add a per-Core, cancellation-aware Allocate gate.
• Distinguish a silent relay from a WRAP/DTLS failure only after peer traffic has returned.
• Verify TURN permission before DTLS and retain low-noise relay diagnostics.
• Serialize credential refresh separately from credential state access.
• Keep worker normalization at 9–108 in groups of 9.

Tests

cd core && go test ./...

Observed behavior

With a silent relay, configuration was obtained through healthy relays promptly and workers spread across relays. Failover is relay-specific; it does not indicate an invalid connection password.

Trade-offs

The three config racers intentionally trade a small amount of duplicate startup work for resilience to a silent relay. Allocation pacing is scoped to one Core instance.