fix(proxy): preserve the client-facing port in the /portal redirect

`return 301 /portal/` let nginx build the Location header from its
own internal `listen 80`, dropping the host's published port (e.g.
:8080) entirely - a browser hitting bare "http://host:8080/portal"
got redirected to "http://host/portal/" (port 80) and failed to
connect. Using $http_host keeps the port the client actually used.

proxy/nginx.conf

@@ -32,8 +32,12 @@ http {
     # "/" -> new-frontend block below); the bare-path redirect below only
     # exists to catch "/portal" (no trailing slash), which wouldn't match
     # "location /portal/" and would otherwise silently fall through to "/".
+    # $http_host (not $host) is used explicitly so the Location header keeps
+    # the client-facing port (e.g. :8080) - nginx's own implicit redirect
+    # construction uses its internal `listen` port instead, which silently
+    # drops the port the host actually published this container under.
     location = /portal {
-      return 301 /portal/;
+      return 301 $scheme://$http_host/portal/;
     }
 
     location /portal/ {