chore: switch nginx to HTTP-only for Cloudflare Flexible SSL

Cloudflare terminates TLS at the edge; origin only needs port 80.
Removes SSL cert requirement, drops port 443 from compose.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -53,11 +53,9 @@ services:
     image: nginx:alpine
     restart: unless-stopped
     ports:
-      - "${HOST_PORT:-443}:443"
       - "80:80"
     volumes:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/ssl:/etc/nginx/ssl:ro
     depends_on:
       - backend
       - frontend

nginx/nginx.conf

@@ -7,26 +7,14 @@ http {
     keepalive_timeout 65;
     client_max_body_size 110m;
 
-    # Redirect HTTP → HTTPS
     server {
         listen 80;
-        return 301 https://$host$request_uri;
-    }
 
-    server {
+        # Security headers (Cloudflare handles TLS; these still apply)
-        listen 443 ssl http2;
-        ssl_certificate     /etc/nginx/ssl/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers HIGH:!aNULL:!MD5;
-        ssl_session_cache shared:SSL:10m;
-
-        # Security headers
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
         add_header X-Frame-Options DENY always;
         add_header X-Content-Type-Options nosniff always;
         add_header Referrer-Policy no-referrer always;
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss:;" always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss: https:;" always;
 
         # API
         location /api/ {
@@ -35,7 +23,7 @@ http {
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
         }
 
         # WebSocket