fix: harden deployment smoke validation

[gabedalmolin]

Summary

Harden the Railway deployment smoke validation so production deploys do not fail on normal HTTPS redirects or ambiguous base URL configuration.

What changed

• Added an explicit HTTPS base URL guard in the deploy workflow before smoke validation starts.
• Updated the production smoke script to follow safe redirects and fail with a clearer message when a non-JSON payload is returned.
• Clarified the expected RAILWAY_PUBLIC_URL format in the Railway deployment guide.

Validation

• bash -n scripts/smoke-production.sh
• npm run lint
• npm run typecheck
• npm test
• npm run test:integration when the change affects infrastructure-backed paths

Risks/Notes

• This change only affects deployment validation and deployment docs; there are no runtime API changes.
• The next deploy should still use a canonical HTTPS RAILWAY_PUBLIC_URL value.