fix: finish Railway custom-domain TLS setup

[CountableNewt]

What and why

Complete the custom-domain dashboard migration from Fly to Railway. The Gateway already returns Railway DNS requirements, but the UI ignored them and could keep showing stale hostname/TLS results after another save.

Changes

• Show every Railway ownership, routing, and certificate-validation DNS record with independent status.
• Remove Fly-only routing alternatives and labels; retain deprecated API fields for compatibility.
• Use the query cache as the current result, cancel stale reads, prevent overlapping writes, and expose save failures.
• Document environment-scoped runtime credentials and add provider-state regression coverage.

Verification

• 203 Swift backend tests; 149 frontend tests, including 12 custom-domain regressions.
• Frontend and shared-client typechecks, lint, Next production build, Swift release build.
• Railway deployment-script tests and diff checks.
• Independent code review: no actionable findings.
• Real UI with mocked API at 1280x720: pending -> issued -> replacement hostname, no console errors or horizontal overflow.

Deployment and risk

Development only. Production is not authorized and must remain unchanged. Runtime RAILWAY_PROJECT_TOKEN and CI RAILWAY_DEVELOPMENT_TOKEN are separate prerequisites; existing custom-domain TLS health does not prove self-service provisioning. Authenticated live new-domain issuance remains a post-deploy acceptance check. No schema/data migration or new dependency.

Tracks MCP-4.

[linear-code]

MCP-2