fix: prefer forwarded swagger base url

[gabedalmolin]

Summary

• prefer forwarded host/proto when deriving the public OpenAPI server URL
• keep the local fallback for development and preserve the existing smoke guard
• cover the forwarded-header behaviour in the Swagger contract tests

Validation

• npm run typecheck
• npm run lint
• npm test
• npm run build

Notes

• follows up the previous Swagger fix so Railway public docs advertise https://... instead of http://...