feat(pitch-deck): HTTPS via Nginx reverse proxy on port 3012

- Add Nginx SSL server block for pitch-deck on port 3012
- Route through Nginx instead of direct container port
- Restore secure cookie flag (requires HTTPS)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -61,6 +61,7 @@ services:
       - "3008:3008"     # Admin Core
       - "3010:3010"     # Portal Dashboard
       - "8011:8011"     # Compliance Docs (MkDocs)
+      - "3012:3012"     # Pitch Deck
     volumes:
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
       - vault_certs:/etc/nginx/certs:ro
@@ -873,8 +874,8 @@ services:
       dockerfile: Dockerfile
     container_name: bp-core-pitch-deck
     platform: linux/arm64
-    ports:
-      - "3012:3000"
+    expose:
+      - "3000"
     environment:
       NODE_ENV: production
       DATABASE_URL: postgres://${POSTGRES_USER:-breakpilot}:${POSTGRES_PASSWORD:-breakpilot123}@postgres:5432/${POSTGRES_DB:-breakpilot_db}