refactor: drop built-in HTTPS, serve plain HTTP behind reverse proxy

TLS termination belongs to the trusted reverse proxy in front
(nginx/caddy/...), not the app. run.py now binds plain HTTP to
127.0.0.1 (HOST/PORT configurable) and the dirty rollback of the
reverted self-signed-cert logic was cleaned up. README updated.
Verified: all endpoints 200 over HTTP, integrity tests 3/3 passing.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

run.py

@@ -1,7 +1,12 @@
-"""Dev/Prod entry point. Runs the Flask app, over TLS when certs exist."""
+"""Entrypoint. Runs the Flask app over plain HTTP on a local port.
+
+TLS is NOT terminated here: a trusted reverse proxy (nginx/caddy/...)
+in front handles HTTPS and forwards to this internal HTTP port. The
+proxy must be the only thing reachable from outside; bind this app to
+127.0.0.1 (or a private interface) only.
+"""
 
 import os
-import ssl
 
 from backend.app import app
 from backend import storage
@@ -10,16 +15,10 @@ from backend import storage
 def main():
     storage.init_db()
 
-    cert = os.path.join("certs", "cert.pem")
-    key = os.path.join("certs", "key.pem")
+    host = os.environ.get("HOST", "127.0.0.1")
+    port = int(os.environ.get("PORT", "5000"))
 
-    if os.path.exists(cert) and os.path.exists(key):
-        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        context.load_cert_chain(cert, key)
-        app.run(host="127.0.0.1", port=8443, ssl_context=context)
-    else:
-        print("WARNING: no certs/ found, running WITHOUT TLS (dev only!).")
-        app.run(host="127.0.0.1", port=5000)
+    app.run(host=host, port=port)
 
 
 if __name__ == "__main__":