Operationally: tiered rate limits per user, a one-build-at-a-time concurrency guard, a daily spend cap that pauses builds, and a health endpoint reporting uptime, database state, todays spend, and whether builds are paused. Deployed on Railway from a Docker image, behind a CI pipeline that runs syntax, unit, and end-to-end suites on every push — a red suite blocks the merge, so it never reaches production.