Serve the site over HTTPS: NPM publishes only 80/81, port 443 has no listener

## Context
On 2026-06-22, `http://cired.digital` returned 200, but `https://cired.digital` timed out — port 443 has no listener at all. The stack is HTTP-only by design:
- `deploy/compose.yaml` nginx-proxy-manager service publishes only `80:80` and `81:81`; there is no `443:443` mapping and no TLS cert.
- `src/frontend/settings.js` hardcodes `http://r2r-api.cired.digital` and `http://cirdi-api.cired.digital`.

Host `ss` confirmed only `:80`/`:81` listen. This has been the case for the NPM container's full uptime. It now reads as 'site down' because browsers increasingly force HTTPS-First / auto-upgrade `http://` to `https://`, which then times out.

## Actions
- [ ] Add `443:443` to the nginx-proxy-manager ports in `deploy/compose.yaml`.
- [ ] In NPM admin (port 81), add a Let's Encrypt cert + proxy hosts for `cired.digital`, `r2r-api.cired.digital`, `cirdi-api.cired.digital`, with HTTP→HTTPS redirect.
- [ ] Flip the prod URLs in `src/frontend/settings.js` to `https://` (avoids mixed-content once the page is served over TLS).

## Verification
- [ ] `curl -I https://cired.digital` returns 200 with a valid cert.
- [ ] A RAG query from the browser succeeds over HTTPS (no mixed-content block).

Start with deploy/compose.yaml to inspect the nginx-proxy-manager port mappings, then review src/frontend/settings.js for the production API URLs. Use the NPM admin on port 81 to configure certificates, proxy hosts, and HTTP-to-HTTPS redirects. Done means curl -I https://cired.digital returns 200 with a valid certificate and a browser RAG query succeeds without mixed-content errors.

Written by the indexing model from the issue text.