Some fixes

WEBSOCKET_NETWORKING.md

@@ -144,14 +144,15 @@ Networking is enabled for Windows and the Emscripten web client:
 - `proj-web/CMakeLists.txt` defines `NETWORK`, compiles the shared protocol,
   replica, and remote-host code, and links Emscripten's `websocket.js` library.
   `WebsocketGameClient.cpp` selects the browser WebSocket API on Emscripten; it
-  does not use Boost.Asio or Boost.Beast there.
-- `wss://` (TLS) is supported by the Windows client only. `proj-windows` also defines
+  does not use Boost.Asio, Boost.Beast, or OpenSSL there. The browser performs
+  the TLS handshake and certificate/hostname validation for `wss://`.
+- `proj-windows` defines
   `NETWORK_TLS` and links static OpenSSL 3.4.1, which CMake downloads and builds
   automatically at configure time (`cmake/ThirdParty.cmake`, section 12) using a
   downloaded portable Strawberry Perl and the nmake from the installed Visual Studio
   (located through `vswhere`). Builds go to `thirdparty/openssl-3.4.1/install-Debug`
   and `install-Release`; later configures skip them. `NETWORK_TLS` unset (server tests)
-  means `wss://` endpoints fail with a logged error.
+  means native `wss://` endpoints fail with a logged error.
 - Linux and Android builds do not define `NETWORK` and do not compile the
   network transport.
 
@@ -170,15 +171,24 @@ Run it from the repository root:
 .\server\build\Debug\GameServer.exe --campaign battle_zone_multiplayer --location uni_exterior
 ```
 
-The listener defaults to `0.0.0.0:8080`. It can be changed with:
+The listener defaults to `0.0.0.0:8080` and serves plain WebSocket traffic. It can be changed with:
 
 ```text
 --address IP
 --port N
 ```
 
-Launch the Windows game and select `battle_zone_multiplayer`. The client connects to
-`127.0.0.1:8080`. Selecting another campaign continues to use the local server.
+Launch the Windows game and select `battle_zone_multiplayer`. The production client
+default is `wss://api.shadowoverbishkek.com/server001/`; the endpoint is currently
+configured in `Game.cpp`. Selecting another campaign continues to use the local
+server.
+
+For the Web build, serve the page over HTTPS and ensure the TLS-terminating reverse
+proxy presents a valid certificate for `api.shadowoverbishkek.com`, accepts the
+WebSocket upgrade at `/server001/`, and forwards the upgraded connection to the
+plain server listener. A page served over HTTPS cannot connect to a `ws://` endpoint
+because browsers block that mixed-content request. Certificate and hostname errors
+are enforced by the browser and cannot be bypassed by the C++ client.
 
 ## Verification