Prod infra: frontend on port 3001, remove certbot from compose

- Frontend container nginx listens on 3001 instead of 80 to avoid
  conflicts with the host-level reverse proxy
- Removed certbot service, volumes, and SSL config from
  docker-compose.prod.yml — SSL/certbot is managed at the host level
- Updated nginx/production.conf: HTTP-only (host handles TLS),
  upstream frontend points to port 3001
- Updated nginx/ssl.conf frontend upstream to 3001 for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nginx/ssl.conf

@@ -3,7 +3,7 @@ upstream backend {
 }
 
 upstream frontend {
-    server frontend:5173;
+    server frontend:3001;
 }
 
 # Redirect all HTTP to HTTPS