Add Nginx reverse proxy config, TLS setup script

[dashprotocol]

Summary

• Adds the Nginx reverse proxy layer and Let's Encrypt TLS setup for the
  production host.
• HTTP-only nginx config committed as a template; Certbot modifies it in-place
  on the host to add SSL directives and the 301 redirect block.
• Idempotent nginx-tls.sh handles the full setup sequence: DNS precheck,
  package install, config deploy, cert issuance, and renewal timer.
• CORS updated to support a CORS_ORIGIN env var in production while always
  including dev localhost origins.
• Operator runbook committed with D0 checklist, evidence commands, renewal
  ops, and rollback steps.

Deploy gate (D0)

Code is complete. D0 requires live-host verification (run nginx-tls.sh,
verify cert, 301 redirect, and dry-run renewal). Will be completed on the host
before or immediately after merge.

Test plan

• bash -n infra/nginx-tls.sh passes (syntax check)
• cd server && npm run build passes
• Run nginx-tls.sh on Lightsail host and work through D0 checklist in
  docs/runbook/nginx-reverse-proxy-tls.md