deploy: prepare Railway hosting

[fly1d]

What changed

• Add Railway Railpack configuration with npm start, /health, a 30-second health timeout, and bounded restart-on-failure behavior.
• Support provider-assigned HOST and PORT, a shared QUICKLEARN_DATA_DIR, and graceful SIGTERM/SIGINT shutdown.
• Fail closed when a publicly bound instance has no explicit persistent commercial data directory: health and commercial APIs return 503.
• Add a deployment smoke command that requires HTTPS for public origins and verifies health, free MCP analysis, and sensitive-path 404 responses without creating a lead.
• Document current Railway pricing, Free-plan validation, /data volume setup, environment variables, backups, post-deploy persistence checks, cost controls, and rollback.

Related to #15. This PR prepares the repository but intentionally does not close the issue; creating the Railway project, volume, and public domain still requires owner authorization.

Risk

• Low: copy, styles, documentation, or isolated cleanup
• Medium: interaction, API response, or shared behavior
• High: fetching, security boundary, deployment, or data compatibility

Verification

• npm run ci passes locally
• I tested the main user path affected by this change
• I checked desktop/mobile layout when UI changed
• I added or updated tests for behavior changes
• I documented anything intentionally not tested

Verification notes:

All 22 local checks pass. An independent process bound to 0.0.0.0 with an explicit temporary data directory passed npm run deploy:smoke: health, MCP analysis, and sensitive-path protection. A second publicly bound process without QUICKLEARN_DATA_DIR returned 503 from both /health and the purchase-intent API. The same fail-closed case is covered by automated tests. Public HTTP is rejected by the smoke script while localhost HTTP remains available for rehearsal. SIGINT shut both platform-simulation processes down cleanly.

Not tested: a real Railway build, domain, Volume restart, or backup restore. Those require logging into an external Railway account and creating resources; Issue #15 remains open until they pass.

No UI layout changed in this PR; the previous desktop/mobile validation remains applicable.

Review and release

• The diff is focused and contains no unrelated changes
• Error, empty, loading, and recovery states were considered
• Security and privacy impact was considered
• Rollback is understood

Rollback plan:

Revert this PR to return to local-only binding and per-file commercial data paths. If already deployed, first export the private Volume data, then roll Railway back to the previous successful deployment or disable the public domain. Never remove the Volume before required fulfillment data is backed up and no longer needed.

[fly1d]

Code review completed with no blocking findings. Verified: Railway config uses Railpack, npm start, a bounded health timeout, and restart-on-failure; HOST/PORT and a shared commercial data directory are supported; public binding without an explicit data directory fails closed with 503 for health and commercial APIs; the deploy smoke requires HTTPS outside localhost and creates no lead; sensitive paths remain 404; SIGINT platform simulations exit cleanly; no tokens, local test paths, or credentials are committed; all 22 local checks and the final GitHub Smoke pass. A real Railway build, Volume mount/restart, public domain, backup restore, and cost limit still require owner account authorization, so Issue #15 correctly remains open.