Configure Railway production tokens for tenant domains and CI deploys

[CountableNewt]

Goal

Finish the two authenticated Railway token setup steps that could not be completed during #22.

Scope

• Create a production-scoped Railway project token and set it as RAILWAY_PROJECT_TOKEN on the production Gateway.
• Verify new tenant custom-domain provisioning no longer fails closed with HTTP 503.
• Create a production deployment token and store it as the GitHub Actions secret RAILWAY_PRODUCTION_TOKEN.
• Run an authenticated production deploy dry run or equivalent token-scope check without changing application behavior.
• Complete an interactive GitHub sign-in/session-cookie round trip on the Railway production stack.

Context

#22 migrated production and permanently retired the Fly, Supabase, and Vercel rollback resources. Existing production domains are healthy; this issue tracks authenticated dashboard configuration that requires a signed-in Railway/browser session.

[linear-code]

MCP-4