fix: make deployment smoke checks more resilient

[gabedalmolin]

Summary

Make production smoke validation more resilient to Railway startup timing and return clearer diagnostics when the public URL is misrouted or not yet serving JSON endpoints.

What changed

• Reworked the production smoke script to poll endpoints with explicit attempt windows instead of failing fast on HTTP 404 responses.
• Added clearer failure output that reports the last HTTP status code and a payload preview.
• Documented that RAILWAY_PUBLIC_URL must belong to the same Railway service targeted by RAILWAY_SERVICE.

Validation

• bash -n scripts/smoke-production.sh
• npm run lint
• npm run typecheck
• npm test
• npm run test:integration when the change affects infrastructure-backed paths

Risks/Notes

• This does not hide a wrong public URL; it only gives the deployment more time to become reachable and produces better diagnostics if it still fails.
• If /health keeps returning 404 after the retry window, the Railway public domain is likely pointing to the wrong service or a stale deployment.