Prod infra: frontend on port 3001, remove certbot from compose

- Frontend container nginx listens on 3001 instead of 80 to avoid
  conflicts with the host-level reverse proxy
- Removed certbot service, volumes, and SSL config from
  docker-compose.prod.yml — SSL/certbot is managed at the host level
- Updated nginx/production.conf: HTTP-only (host handles TLS),
  upstream frontend points to port 3001
- Updated nginx/ssl.conf frontend upstream to 3001 for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/Dockerfile

@@ -18,5 +18,5 @@ COPY --from=builder /app/dist /usr/share/nginx/html
 # Copy a small nginx config for SPA routing
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 
-EXPOSE 80
+EXPOSE 3001
 CMD ["nginx", "-g", "daemon off;"]

frontend/nginx.conf

@@ -2,7 +2,7 @@
 # The outer nginx reverse proxy forwards non-API requests here.
 
 server {
-    listen 80;
+    listen 3001;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;