feat(pitch-deck): HTTPS via Nginx reverse proxy on port 3012

- Add Nginx SSL server block for pitch-deck on port 3012
- Route through Nginx instead of direct container port
- Restore secure cookie flag (requires HTTPS)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pitch-deck/lib/admin-auth.ts

@@ -112,7 +112,7 @@ export async function setAdminCookie(jwt: string): Promise<void> {
   const cookieStore = await cookies()
   cookieStore.set(ADMIN_COOKIE_NAME, jwt, {
     httpOnly: true,
-    secure: process.env.PITCH_SECURE_COOKIE === 'true',
+    secure: process.env.NODE_ENV === 'production',
     sameSite: 'lax',
     path: '/',
     maxAge: ADMIN_SESSION_EXPIRY_HOURS * 60 * 60,