feat: deploy to Frostmoln production (#391)

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`), with unboundsoftware/schemas.

- `deploy-prod` (AWS, failing since CI left AWS) → `deploy-prod-frostmoln`: `deploy prod-frostmoln -n schemas`.
- Restricted Pod Security: `nginxinc/nginx-unprivileged` (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). `nginx.conf`: no `user`, pid and temp paths under `/tmp`, `listen 8080`. Configs copied with `--chmod=644`. Service is ClusterIP.
- `autoscale-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/` on `schemas.unbound.se` (the API's `/query` ingress wins on the longer path).

Checked locally (amd64): as uid 101 with all capabilities dropped, `/health`, `/` and SPA routes 200, security headers present.

**Merge with** the schemas PR, after infra#1878 is applied.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
Reviewed-on: #391

nginx/nginx.conf

@@ -1,14 +1,20 @@
-user  nginx;
 worker_processes  auto;
 
 error_log  /var/log/nginx/error.log notice;
-pid        /var/run/nginx.pid;
+pid        /tmp/nginx.pid;
 
 events {
   worker_connections  1024;
 }
 
 http {
+  # Writable by the unprivileged (uid 101) worker.
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path       /tmp/proxy_temp_path;
+  fastcgi_temp_path     /tmp/fastcgi_temp;
+  uwsgi_temp_path       /tmp/uwsgi_temp;
+  scgi_temp_path        /tmp/scgi_temp;
+
   include       /etc/nginx/mime.types;
   default_type  application/octet-stream;
   types {
@@ -22,7 +28,7 @@ http {
   keepalive_timeout  65;
 
   server {
-    listen       80;
+    listen       8080;
     server_name  localhost;
     root         /usr/share/nginx/html;
     index        index.html index.htm;