Complete provider-console security setup

[NMSOfficial]

The code, database policies, CI and deployments are hardened. These remaining steps require access to external provider consoles that are not connected to this workspace.

Resend / DNS

Add the following records at the authoritative DNS provider for ethosoft.org, then run verification again:

• DKIM TXT — host: resend._domainkey
• SPF MX — host: send, value: feedback-smtp.us-east-1.amazonses.com, priority: 10
• SPF TXT — host: send, value: v=spf1 include:amazonses.com ~all

After status becomes verified:

• Perform a real Pasific password-reset delivery test.
• Confirm RESEND_FROM_EMAIL uses the verified domain.
• Replace Railway's current Resend key with one restricted to sending from this domain.
• Revoke unused keys, especially pasific-railway-api-unrestricted, after confirming the replacement works.

Supabase Auth

In Supabase Dashboard → Authentication → Security / Password settings:

• Enable leaked-password protection.
• Re-test sign-in, activation and password reset.

Railway GitHub integration

In Railway → pasific service → Settings → Source / Deploys:

• Enable Wait for CI so production deployment starts only after the GitHub CI workflow succeeds.
• Confirm the source branch remains main.

The Railway API currently reports checkSuites: false; this flag is not writable through the connected Railway tooling. Railway's documentation describes Wait for CI as a Service Settings control.

Verification evidence

• Resend domain status is currently failed; verification was re-triggered on 2026-08-06.
• Supabase Security Advisor currently reports leaked-password protection as disabled.
• Railway source is now NMSOfficial/pasific:main, with /health, Node startup and production-only dependency installation configured.

Do not paste API keys or password-reset action links into this issue.