fix(release): enforce canonical Production targets

[Alex0158]

Outcome

Closes the remaining canonical-domain configuration gap without removing legacy compatibility aliases.

• makes emorapy.com, admin.emorapy.com, and api.emorapy.com the fail-closed Production targets
• adds a runtime CORS preflight gate for both canonical Web origins
• pins the Mobile Production API base
• updates release helpers, governance checks, examples, Platform Map, runbook, and the existing P0 tracking task

Platform preparation

Before this PR, GitHub, Vercel, and Railway URL/origin variables were updated to canonical values and read back. Railway changes used --skip-deploys; Vercel env changes do not deploy automatically. Live Production therefore remains on the previous baseline until the formal workflow runs after merge.

Verification

• workflow YAML parse: pass
• npm run docs:check: pass
• npm run naming:check: pass
• npm run ops:release:origin-contract:test: 4/4 pass
• npm run ops:release:rollback:test: 13/13 pass
• npm run ops:release:email-contract:test: 9/9 pass
• npm --prefix mobile run typecheck: pass
• npm --prefix mobile run release:check: pass with existing external Apple/Expo warnings only
• npm --prefix backend run prisma:generate && npm --prefix backend run build:prod && npm --prefix backend run lint: pass
• shell syntax and git diff --check: pass

Release plan

After exact-head PR CI and main push CI succeed, run Production Deploy and Verify with Web, backend, and full release gate enabled. Independently verify exact SHA, Railway deployment identity, CORS, static bundle API base, health/readiness, DB parity, smoke-account hygiene, and redirects.