feat: deploy to Frostmoln production

Replace the AWS deploy-prod job (failing since CI left AWS) with deploy-prod-frostmoln, and run under the restricted Pod Security profile with the namespace's oci-registry pull secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi

nginx-conf/default.conf

@@ -1,5 +1,5 @@
 server {
-    listen       80;
+    listen       8080;
     server_name  localhost;
     sendfile     off;
     charset      utf-8;