Document backend deployment on Railway/Render

From the PR description

Summary

• Adds backend/DEPLOY.md with package manager (npm), install/build/start commands, Node version, host-specific steps for Railway and Render, the full env var matrix (required, provider keys, optional), an explicit list of secrets that must never ship to the frontend Worker, frontend wire-up via NEXT_PUBLIC_API_BASE_URL, and a post-deploy smoke test.
• Links the new doc from the root README.md next to the existing Cloudflare Workers section, with a one-liner explaining the backend is not Workers-compatible (Node-only APIs + LibreOffice).
• No code changes; product behavior unchanged.

Findings worth flagging in review

• Frontend reads the backend URL from NEXT_PUBLIC_API_BASE_URL. All call sites use process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost:3001" - the literal localhost:3001 only appears as a dev fallback and is unreachable when the env var is set at build time. The OpenNext build bakes NEXT_PUBLIC_* at cf:build time, so the var must be set before building, not just at runtime.
• The only un-gated localhost is frontend/src/components/site-logo.tsx:20 (http://localhost:3000), but it's behind NODE_ENV === "production" and points to the marketing landing page, not the API. No action needed.
• backend/src/routes/workflows.ts:8 reads process.env.NEXT_PUBLIC_SUPABASE_URL while the rest of the backend reads SUPABASE_URL. The doc instructs operators to set both to the same value as a workaround; flagged as something to unify in a follow-up.
• OPENROUTER_API_KEY and RESEND_API_KEY are listed in .env.example but not currently referenced in backend/src - documented as "set if you use them" rather than required.

Test plan

• Render the new backend/DEPLOY.md on GitHub and confirm the env var tables and code blocks render correctly.
• Deploy backend to Railway following the doc, hit /health, and confirm {"ok":true}.
• Set NEXT_PUBLIC_API_BASE_URL to the deployed backend URL, rebuild and redeploy the frontend Worker, and walk through the post-deploy smoke test (login → upload → ask one question).

https://claude.ai/code/session_019pRkhcGDRKQWHjzAnV5yCL

Generated by Claude Code