Prod infra: frontend on port 3001, remove certbot from compose

- Frontend container nginx listens on 3001 instead of 80 to avoid
  conflicts with the host-level reverse proxy
- Removed certbot service, volumes, and SSL config from
  docker-compose.prod.yml — SSL/certbot is managed at the host level
- Updated nginx/production.conf: HTTP-only (host handles TLS),
  upstream frontend points to port 3001
- Updated nginx/ssl.conf frontend upstream to 3001 for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -1,25 +1,21 @@
 # Production override — use with:
 #   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
 #
-# For SSL add docker-compose.ssl.yml as well:
-#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.ssl.yml up -d --build
-#
 # What this changes from the base (dev) config:
 #   - Backend: production Dockerfile (compiled JS, no watch, no devDeps)
-#   - Frontend: production Dockerfile (static build served by nginx, not Vite)
+#   - Frontend: production Dockerfile (static build served by nginx on port 3001)
 #   - No source-code volume mounts (uses baked-in built code)
 #   - Memory limits and health checks on backend
+#   - Tuned PostgreSQL for production workloads
 #   - Restart policies for reliability
+#
+# SSL/TLS is handled at the host level (e.g., host nginx + certbot).
+# The Docker nginx container listens on port 80 only.
 
 services:
   nginx:
-    ports:
-      - "80:80"
-      - "443:443"
     volumes:
       - ./nginx/production.conf:/etc/nginx/conf.d/default.conf:ro
-      - certbot_www:/var/www/certbot:ro
-      - certbot_conf:/etc/letsencrypt:ro
     restart: unless-stopped
 
   backend:
@@ -81,16 +77,3 @@ services:
 
   redis:
     restart: unless-stopped
-
-  certbot:
-    image: certbot/certbot:latest
-    volumes:
-      - certbot_www:/var/www/certbot
-      - certbot_conf:/etc/letsencrypt
-    networks:
-      - hoanet
-    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --quiet; sleep 12h & wait $${!}; done'"
-
-volumes:
-  certbot_www:
-  certbot_conf: