...I lied. I haven't eaten or run yet. But I know what's going on. In short, it's a DNS issue, because of course it is.
So I could still move the turnserver to its own backend, or I could try proxying the turnserver and see if that fixes it.
But I have to do other things first.