infra: migrate Railway to new account + wire distrotv.xyz DNS end-to-end

[distroinfinity]

Context

M8 shipped (#70) with the landing page displaying curl -fsSL https://distrotv.xyz/install.sh | sh as the install one-liner. That URL doesn't resolve yet because:

1. distrotv.xyz DNS is registered (GoDaddy) but not pointed at Vercel. Currently resolves to GoDaddy parking IPs.
2. The Railway API service on the old account expired (last successful deploy was May 7, trial ran out). The service still has the pre-pivot env vars (api.devdrip.xyz, WORLD_CHAIN_RPC, MINIAPP_BASE_URL, CARBON_*, GITHUB_CLIENT_*, etc.).
3. packages/shared/src/env-bundle.ts still hardcodes devdrip.xyz / devdrip-api-{staging,production}.up.railway.app / auth@devdrip.xyz for prod and staging.

The install.sh script itself is functional — the GitHub Releases URL it points at (releases/latest/download/distrotv-cli.tar.gz) is live and serves the real tarball (cli-v0.1.0, 139KB). All that's missing is the user-facing host wiring.

Scope

Railway migration (new account)

• Create project distrotv-api on the new Railway account, link to distroinfinity/devdrip repo
• Service config: builder Railpack, deploy on push to main
• Copy these env vars from the old prod service (still valid): DATABASE_URL, DATABASE_URL_UNPOOLED, DB_TARGET=neon, JWT_SECRET, PORT=3000, NODE_ENV=production, UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN
• Add (from .env.shared / M7+ additions): RESEND_API_KEY, MAGIC_LINK_FROM_EMAIL (post-Resend-verify, see below), ADMIN_EMAILS, ADMIN_SECRET (mint fresh), DISTRO_ENV=prod
• Drop (dead pre-pivot): WORLD_CHAIN_RPC, WORLD_ID_ACTION, MINIAPP_BASE_URL, CARBON_*, GITHUB_CLIENT_*, GITHUB_CALLBACK_URL
• Update for distrotv.xyz: ALLOWED_ORIGINS=https://distrotv.xyz, CLIENT_REDIRECT_URL=https://distrotv.xyz/auth/callback

DNS (GoDaddy)

• Apex distrotv.xyz: A records → Vercel edge IPs (Vercel UI shows current targets, e.g. 76.76.21.21)
• www.distrotv.xyz: CNAME → cname.vercel-dns.com
• api.distrotv.xyz: CNAME → Railway custom domain target (Railway UI shows this after adding api.distrotv.xyz as a custom domain on the new service)

Vercel

• Add distrotv.xyz + www.distrotv.xyz as production domains on the frontend project
• Confirm distrotv.xyz/install.sh serves the install script post-deploy

Resend

• Add distrotv.xyz as a verified domain in Resend
• Paste the provided TXT/MX records into GoDaddy
• Wait for verification, then update Railway MAGIC_LINK_FROM_EMAIL=auth@distrotv.xyz

Code change (packages/shared/src/env-bundle.ts)

• prod.apiUrl → https://api.distrotv.xyz
• prod.webUrl → https://distrotv.xyz
• prod.magicLinkFromEmail → auth@distrotv.xyz
• staging.* similarly (or remove staging bundle if no staging is being run)

Docs

• Update any remaining devdrip.xyz / devdrip-api-*.up.railway.app references in gitbook-docs
• Update CLAUDE.md if any prod URL is referenced (currently it's not explicit)

Acceptance criteria

• curl -fsSL https://distrotv.xyz/install.sh | sh runs end-to-end on a clean machine (Node 20+)
• https://distrotv.xyz/ serves the M8 landing
• https://api.distrotv.xyz/health returns 200
• Magic-link emails arrive from auth@distrotv.xyz
• env-bundle.ts on main reflects new URLs, all devdrip.xyz references in code are gone
• Old Railway service can be deleted/archived (cleanup task in this issue or follow-up)

Related

• M8 PR: M8: landing page + install vector #70
• Closed pre-pivot PRs: landing: world-branded revamp + install one-liner #59 (landing/world-revamp), cli: 0.1.0 release prep #60 (cli/v0.1.0 npm publish), env-bundle + railway/reuters/ticker fixes #66/followup: nixpacks corepack + inline env-bundle in next.config #67 (env-bundle + nixpacks fixes)
• Spec/plan files: docs/superpowers/specs/2026-05-19-m8-landing-page-design.md, docs/superpowers/plans/2026-05-19-m8-landing-page.md (both local-only per .gitignore)