docs(rees): lead with self-host docker-compose, retire our Railway deployment - #3883

Summary

• REES self-hosting via docker compose --profile rees (added just before this PR) is now production-validated end-to-end on edge-us-01 (real /v1/enrich call, full analyzer registry ran, HTTP 200). This PR re-frames the docs around it as the recommended default instead of an afterthought under an external-instance-first structure, and cleans up the config for the Railway deployment gittensory itself no longer uses.
• apps/gittensory-ui/src/routes/docs.self-hosting-rees.tsx: merges the previously-separate "Engine configuration" and "Self-hosting REES" sections into one "Run REES" flow that leads with the in-network docker-compose path (no separate service to host), with "point at an external or managed instance instead" demoted to an explicit, clearly-alternative subsection. Removes the duplicate .env blocks the old structure had.
• review-enrichment/README.md: drops the "standalone Railway microservice" opening framing (REES is deployment-target-agnostic), generalizes the /health endpoint description and the stale-build note in "Shared analysis context" (neither is actually Railway-specific), and points at self-hosting as the simplest path ahead of the Railway deploy section.
• Removes review-enrichment/railway.json: this repo's own self-hosted engine (edge-us-01) has been fully cut over to the in-network rees service and no longer depends on the Railway deployment that config pointed at. That Railway project (enrichment-gittensory) has separately been decommissioned via the Railway CLI. The Railway deploy path itself remains documented and supported in the README for anyone who wants to run REES there — only our own no-longer-used project config is removed.
• Explicitly untouched: the top-level railway.json (a separate, still-valid Railway deploy option for the main self-host image, unrelated to REES) and the generic "railway.json" infra-file-pattern entry in src/signals/path-matchers.ts (used to recognize Railway configs in any repo gittensory reviews, unrelated to gittensory's own deployment).

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

All run via npm run test:ci (full local gate, green) plus a standalone npm audit --audit-level=moderate (0 vulnerabilities). This is a docs/config-removal-only change (no src/** logic touched), so there's no new branch coverage obligation — verified via ui:lint/ui:typecheck/ui:build that the doc page still compiles and renders correctly after the restructure.

Beyond the local gate, I did live infrastructure verification (not something CI can check): confirmed on edge-us-01 that the in-network rees container is healthy, the engine's post-cutover /v1/ping handshake succeeded (rees_ping_ok), and a real synthetic /v1/enrich call through the container network returned a full HTTP 200 ReviewBrief with the complete analyzer registry executing (including network-calling analyzers like dependency/license). Separately confirmed via railway link -p enrichment-gittensory that the old Railway project no longer exists in the account.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Docs-and-config-only change: no auth/CORS/session/API behavior touched. The doc page shows static reference content (no live data to mock), so no UI Evidence table applies — this is prose/config restructuring, not a visual/interactive change.

UI Evidence

N/A — text/prose restructuring on an existing docs page; no visual or interactive change.

Notes

• The actual Railway project decommission (CLI railway delete) and the edge-us-01 cutover to the in-network REES service happened outside this repo/PR — this PR is the documentation and repo-config side of that already-completed operational change.