fix: prefer https for public swagger urls

[gabedalmolin]

Summary

Ensure the public Swagger spec advertises the deployed HTTPS origin so Swagger UI Try it out works correctly on Railway.

What changed

• prefer HTTPS for non-local Swagger server URLs when the proxy reports an internal HTTP hop
• keep localhost behaviour unchanged for local development
• extend Swagger contract coverage for the public Railway host case

Validation

• npm run lint
• npm run typecheck
• npm test
• npm run test:integration when the change affects infrastructure-backed paths

Risks/Notes

• this change only affects generated Swagger server metadata; runtime routing stays unchanged
• after merge, redeploy the Railway service so /docs.json and /docs pick up the corrected public origin