Run app nginx behind host reverse proxy

[dgknttr]

Summary

• Change production compose to bind app nginx to localhost:3000 instead of public 80/443
• Remove container-level TLS handling; host nginx remains the edge TLS reverse proxy
• Preserve forwarded scheme when proxying from app nginx to backend

Reason

The first v0.1.0 deploy failed because host nginx already owns port 80. This keeps the Docker app behind host nginx, which is the intended production topology.