Add ALLOW_RAILWAY_ORIGINS env var that enables regex-based CORS
allowing any *.up.railway.app origin. This makes PR environment
testing work without manually setting FRONTEND_URL for each PR.
Set ALLOW_RAILWAY_ORIGINS=true in Railway backend env vars.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>