Harden GrowthPath Mail production before the first cutover

[vladbisceanu]

Delivers: a provider-native Railway deployment health gate for /api/health, a verified recoverable Postgres backup path, and protected delivery through pull requests on growthpath-mail without breaking Railway deployments.

Done when: Railway waits for the real health endpoint before accepting a deployment; point-in-time recovery or an explicitly approved equivalent backup/restore procedure is enabled and restore-tested; the production branch requires the checks that actually run in this fork; and the live deployment SHA plus health response are recorded after any resulting deploy.

Do not introduce bespoke backup or deployment machinery while Railway's native controls satisfy the requirement. Read the design and data-safety constraints in the parent epic before changing provider state.

[vladbisceanu]

Recovery proof completed before the hardening merge:

• Railway PITR enabled on production Postgres a19e9faa-cefc-4626-8c58-2f21fc6810a8; enabling redeployed it as b9b46d38-4860-41fa-97cf-2694c8e679e7, which reached SUCCESS.
• Production /api/health returned HTTP 200 after the database redeploy.
• PITR accepted target 2026-08-26T11:10:00Z and workflow createServiceFromPITR/a3dd500f-ef17-420d-87cd-ecd48800e4aa/cc478fbd-1030-43d3-82e7-e6b6c7056f7d/9Q3rPYUdIFyQyxSEh_XJY.
• Restored private sibling usesend-recovery-proof-20260826 (a5a8001a-f38e-4aad-9b09-7769c15b65fb) reached SUCCESS as deployment 2494627a-4de2-4776-baed-78b378f276c2; it had no custom or service domains.
• Private validator deployment bf90eaae-596e-42fe-a38f-c1ec833a996a connected only over Railway's internal network and read back 25 public tables and 41 Prisma migrations. It emitted no row data or secrets.
• Railway useSend now has healthcheckPath=/api/health, a 300-second timeout, and a Prisma pre-deploy command. The next application deployment will exercise that gate.

The validator and restored sibling are temporary and will now be deleted. Production remains on the original Postgres service.

[vladbisceanu]

PR #10 is green on head c8f9c5951855844b00b07c407377a93413dcfc6a: #10

GitHub Actions run 32963271114 completed successfully, including all web tests and the production Docker build. growthpath-mail now strictly requires the app-bound Production gate check, requires PRs with zero approvals for solo-safe delivery, enforces protection for admins, requires conversation resolution, and disallows force pushes and deletion. Merging the exact reviewed head now.

[vladbisceanu]

Implemented and proven in production.

• PR: feat: gate production on readiness #10
• merge commit: 0e2d8d04d0637e32f10275d36490cdfc4f0d8d1f
• always-running required gate: Production gate run 32963853528 — success on the exact merge commit, including typecheck, 202 tests, and the production Docker build
• growthpath-mail protection: strict GitHub Actions app-bound Production gate; admins enforced; conversations must be resolved; force pushes and deletion disabled; zero required approvals so the solo-maintainer flow remains usable
• Railway deployment: 72a8059b-bf20-4057-a9ee-ee8c7e90c2e8 — SUCCESS for the exact merge commit
• pre-deploy migration log: 41 migrations found, no pending migrations
• public readiness proof: GET https://send.growthpath.systems/api/health returned HTTP 200 with {"data":"Healthy","commitSha":"0e2d8d04d0637e32f10275d36490cdfc4f0d8d1f"}
• provider healthcheck: /api/health, 300-second timeout
• recovery proof: the earlier sibling PITR restore reached SUCCESS, aggregate-only validation found 25 public tables and 41 migrations, and both temporary services were deleted; PITR remains enabled

The unrelated existing lint baseline is tracked separately in #9 and is not part of the required gate.