Add a Railway template for Nominal

[tomschlick]

Summary

Adds a Railway template that deploys Nominal from ghcr.io/returnearly/nominal:latest with web, worker, scheduler, Postgres, and a one-shot migrate service.

• railway/template.json is the template config. Railway generates APP_KEY and NOMINAL_ADMIN_PASSWORD once on web; the other app services reference those values. Postgres generates its own password and private DATABASE_URL.
• web runs Octane on port 8080 with a public domain and a /up health check.
• worker listens on checks.$PROBE_REGION and default. scheduler runs schedule:work.
• migrate retries php artisan migrate --force until Postgres is up, then runs nominal:provision and exits. That command creates the default probe and the first admin user. An existing admin keeps their password.
• TRUSTED_PROXIES=* so Railway's proxy preserves HTTPS.

The migrate script and nominal:provision ship in the image, so this template matches latest after this lands on master.

Test plan

• php artisan test --compact tests/Feature/ProvisionInstanceTest.php tests/Feature/TrustedProxiesTest.php tests/Unit/RailwayTemplateTest.php tests/Arch/ArchTest.php
• Deploy the template on Railway and confirm web reaches /up, migrate exits 0, and /admin accepts NOMINAL_ADMIN_EMAIL / NOMINAL_ADMIN_PASSWORD
• Confirm worker, scheduler, and migrate resolve the same APP_KEY as web