Initially I expect traffic to my web application to be minimal and I do not want to bear the cost of a load balancer. But if my application gains traction then I may configure a load balancer later. Is it possible to use AWS Fargate without a load balancer?
That's not easily achievable, see this thread - https://forums.aws.amazon.com/thread.jspa?messageID=931880
The simplest approach is to assign a load balancer. If you really don't want to do that they suggest running some script that will update the DNS every time a task is deployed.
I believe you should go with a LB as long as there's no traction the cost is negligible.
Not purely on AWS if you want https. With HTTP it is possible using the ECS Service Discovery. You could technically combine CloudFlare with ECS/Service Discovery for HTTP and configure your security groups to block all traffic except CloudFlare (they publish an IP list), and this will allow your public site to be secure while avoiding the need to use an ALB on AWS.