is if there is a Railway-native feature that allows me to add an arbitrary passcode or username/password to protect my deployed apps

There is not, this has to be added by you (like a reverse proxy) or the app you are deploying.

How have you deployed Fathom to Railway? Are you aware that the self-hosted version hasn't been updated in 4 years?

Makes sense!

I used this template: https://railway.app/template/dXJiR5. But that's good to know; some of the other self-hosted options, like Umami and Matomo, seem more desirable to me anyway.

That template does not have data persistence, if you were to redeploy it for whatever reason you would lose all your analytics. I would highly recommend you use something else, like Swetrix, umami, Matomo, or Ackee

Thanks for the help! Which do you prefer, if any?

Oh yeah forgot about Plausible, it looks like that template is of decent quality and has a 100% deployment success rate.

I have only used umami myself so I'm probably not the best to ask, do some research, pick one, and if you don't like it simply delete the project and try a different template!