feat: redesign around phenotype-driven triage, not variant filtering

A table with filters made the user do the work. Rare disease triage is a different task:
which few variants could explain *this* patient's phenotype, and why. The app now answers
that, and lets a reviewer act on the answer.

Domain
- a case is a proband: a VCF plus the HPO terms observed in the patient (samples -> cases)
- HPO's gene-to-phenotype annotations are loaded as reference data (scripts/load-hpo.py)
- each candidate can be shortlisted or dismissed with a reason and a note

Ranking (app/services/triage.py, 21 tests)
- weighted sum of phenotype match, rarity, consequence severity and the model's score,
  with every component shown next to the candidate
- rarity and consequence filter; phenotype only ranks, because a real diagnosis can sit in
  a gene nobody has annotated yet and filtering on it would hide exactly that case
- ClinVar is deliberately not an input: it appears beside the result as independent
  confirmation, so nothing ranks highly merely because ClinVar already said pathogenic

UI
- the funnel is the headline: variants called -> rare -> coding candidates -> phenotype-matched
- ranked candidates with evidence chips, not a grid of everything; filters are demoted
- a variant panel showing the score breakdown, the matched HPO terms, the raw VEP record and
  links out to Ensembl/gnomAD/ClinVar, with the decision controls
- a printable case report: phenotype, funnel, shortlisted variants with reasons, provenance

API: /cases with phenotypes, /cases/{id}/candidates (funnel + ranked + weights),
/variants/{id}, /variants/{id}/decision, /cases/{id}/report, /phenotypes for the picker.
Scoring moved under the case and now answers 503 with the reason when no model registry is
reachable, instead of a 500.

Verified end to end on a simulated proband (scripts/make-demo-case.sh: real GIAB HG002
background + one real ClinVar 2-star pathogenic NF2 variant). 13 variants called -> 1 coding
candidate, and the planted variant ranks first at 0.80 on phenotype 1.00, rarity 1.00 and
consequence 1.00, with ClinVar agreeing afterwards.

Tests: api 75, ml 18, loader 16, web 27; ruff, mypy, svelte-check, terraform validate, both
kustomize overlays and the Nextflow stub run all clean.

api/tests/test_scoring.py

@@ -4,11 +4,12 @@ import uuid
 import numpy as np
 import pandas as pd
 import pytest
+from factories import seed_case
 from httpx import AsyncClient
 from sqlalchemy import select
 
 from app.db import SessionLocal
-from app.models import Job, JobStatus, Prediction, Sample, Variant
+from app.models import JobStatus, Prediction, Variant
 from app.services import scoring
 
 
@@ -40,20 +41,16 @@ class FakeModel:
         return np.full(len(frame), self.score)
 
 
-async def make_job(status: JobStatus, n_variants: int) -> uuid.UUID:
-    async with SessionLocal() as s:
-        sample = Sample(name=f"s-{uuid.uuid4()}", vcf_uri="gs://b/x.vcf.gz", assembly="GRCh38")
-        job = Job(sample=sample, status=status)
-        s.add_all([sample, job, *(variant(job=job, pos=i + 1) for i in range(n_variants))])
-        await s.commit()
-        return job.id
+async def make_case(status: JobStatus, n_variants: int) -> tuple[uuid.UUID, uuid.UUID]:
+    return await seed_case(
+        status=status,
+        variants=[{"pos": i + 1, "annotations": {}} for i in range(n_variants)],
+    )
 
 
 async def predictions(job_id: uuid.UUID) -> list[Prediction]:
     async with SessionLocal() as s:
-        rows = await s.scalars(
-            select(Prediction).join(Variant).where(Variant.job_id == job_id)
-        )
+        rows = await s.scalars(select(Prediction).join(Variant).where(Variant.job_id == job_id))
         return list(rows)
 
 
@@ -61,15 +58,15 @@ async def predictions(job_id: uuid.UUID) -> list[Prediction]:
 async def test_scoring_twice_updates_instead_of_failing(
     client: AsyncClient, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    job_id = await make_job(JobStatus.succeeded, n_variants=3)
+    case_id, job_id = await make_case(JobStatus.succeeded, n_variants=3)
 
     monkeypatch.setattr(scoring, "load_model", lambda: (FakeModel(0.9), "7"))
-    r = await client.post(f"/api/predictions/score/{job_id}")
+    r = await client.post(f"/api/cases/{case_id}/score")
     assert r.status_code == 200, r.text
-    assert r.json() == {"job_id": str(job_id), "scored": 3, "model_version": "7"}
+    assert r.json() == {"case_id": str(case_id), "scored": 3, "model_version": "7"}
 
     monkeypatch.setattr(scoring, "load_model", lambda: (FakeModel(0.2), "8"))
-    r = await client.post(f"/api/predictions/score/{job_id}")
+    r = await client.post(f"/api/cases/{case_id}/score")
     assert r.status_code == 200, r.text
 
     preds = await predictions(job_id)
@@ -78,13 +75,28 @@ async def test_scoring_twice_updates_instead_of_failing(
 
 
 @pytest.mark.usefixtures("db")
-async def test_scoring_unknown_job_is_404(client: AsyncClient) -> None:
-    r = await client.post(f"/api/predictions/score/{uuid.uuid4()}")
+async def test_scoring_an_unknown_case_is_404(client: AsyncClient) -> None:
+    r = await client.post(f"/api/cases/{uuid.uuid4()}/score")
     assert r.status_code == 404
 
 
 @pytest.mark.usefixtures("db")
-async def test_scoring_unfinished_job_is_409(client: AsyncClient) -> None:
-    job_id = await make_job(JobStatus.running, n_variants=1)
-    r = await client.post(f"/api/predictions/score/{job_id}")
+async def test_scoring_before_the_annotation_finishes_is_409(client: AsyncClient) -> None:
+    case_id, _ = await make_case(JobStatus.running, n_variants=1)
+    r = await client.post(f"/api/cases/{case_id}/score")
     assert r.status_code == 409
+
+
+@pytest.mark.usefixtures("db")
+async def test_an_unreachable_model_registry_is_explained_not_a_500(
+    client: AsyncClient, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    case_id, _ = await make_case(JobStatus.succeeded, n_variants=1)
+
+    def unreachable() -> tuple:
+        raise ConnectionError("connection refused to http://localhost:5000")
+
+    monkeypatch.setattr(scoring, "load_model", unreachable)
+    r = await client.post(f"/api/cases/{case_id}/score")
+    assert r.status_code == 503
+    assert "connection refused" in r.json()["detail"]