fix(proxy): allow Railway project token header

[odyslam]

Summary

• allow iron-proxy to preserve Railway's Project-Access-Token header
• keep the change scoped to the exact documented Railway project-token header instead of broadening the auth-header regex
• add a proxy-config regression test for the rendered header allowlist

Why

Railway project tokens authenticate with Project-Access-Token, while account/workspace tokens use Authorization: Bearer .... Without this allowlist entry, the proxy strips the project-token header before the request reaches Railway.

Test

• uv run --project services/api pytest services/api/tests/test_proxy_config.py