chore: Remove SSL cert handling - use external reverse proxy

- Nginx now listens on HTTP only (port 80)
- Remove SSL cert volume mounts from docker-compose
- Remove SSL troubleshooting sections
- Update docs to indicate SSL handled by Caddy/reverse proxy
- Simplify nginx.conf to remove HTTPS server block

docs/INFRASTRUCTURE.md

@@ -13,13 +13,13 @@
 │                           CoopCredits Server                              │
 │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
 │  │    Nginx     │  │   Frontend   │  │    Backend   │  │  PostgreSQL  │  │
-│  │   (80/443)   │──│  (Next.js)   │──│  (Express)   │──│   (5432)     │  │
+│  │    (80)      │──│  (Next.js)   │──│  (Express)   │──│   (5432)     │  │
 │  └──────────────┘  └──────────────┘  └──────┬───────┘  └──────────────┘  │
 │                                              │                           │
-│  ┌──────────────┐  ┌──────────────┐         │          ┌──────────────┐  │
-│  │   Certbot    │  │    Redis     │◀────────┘          │  Anchor CLI  │  │
-│  │   (SSL)      │  │   (6379)     │                     │ (Optional)   │  │
-│  └──────────────┘  └──────────────┘                     └──────────────┘  │
+│                    ┌──────────────┐         │          ┌──────────────┐  │
+│                    │    Redis     │◀────────┘          │  Anchor CLI  │  │
+│                    │   (6379)     │                     │ (Optional)   │  │
+│                    └──────────────┘                     └──────────────┘  │
 └──────────────────────────────────┬──────────────────────────────────────┘
                                    │
                                    │ Local Network (172.20.1.0/24)
@@ -132,26 +132,9 @@ sudo ufw deny 6379/tcp    # Redis
 - Subnet: 172.20.2.0/24
 - Used for: backend → Tautulli/Overseer/Plex
 
-## SSL/TLS Setup
+## SSL/TLS
 
-### Let's Encrypt (Recommended)
-```bash
-# Initial certificate
-docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
-  --webroot -w /var/www/certbot \
-  -d coop.hobokenchicken.com \
-  --agree-tos --no-eff-email
-
-# Auto-renewal (configured in docker-compose)
-```
-
-### Self-Signed (Testing only)
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-  -keyout docker/nginx/ssl/key.pem \
-  -out docker/nginx/ssl/cert.pem \
-  -subj '/CN=coop.hobokenchicken.com'
-```
+SSL/TLS is handled by an external reverse proxy (e.g., Caddy). The application stack runs HTTP only on port 80 internally.
 
 ## Monitoring and Logging