fix: overhaul the platform skeleton, add a serverless deployment track

An end-to-end audit found the repo could not build, test or run as shipped. This
fixes every finding, then adds a Cloud Run track so the demo costs about £1/month
idle instead of ~£150.

CI (red on its first run)
- api: setuptools could not build the package (flat layout with app/ and alembic/)
- web: missing @types/node; `vitest run` exited 1 with no test files
- pipeline: the stub run needed a gitignored VCF, and no process had a stub block
- ruff pinned, mypy configured, DB tests on real Postgres (pgserver locally, service in CI)

ML serving (scores were meaningless)
- the registered model now carries its own feature engineering and returns predict_proba,
  so serving sends raw columns and cannot drift from training
- resolve by registry alias (stages are deprecated in MLflow 3) and record the real
  version; re-scoring upserts instead of failing on the unique constraint
- ClinVar labels parsed from VEP's lowercase terms

Pipeline
- exact ref/alt recovered from a CHROM_POS_REF_ALT VCF ID; loading is idempotent
- job status reaches running/failed/succeeded, so the UI stops polling dead jobs
- DATABASE_URL travels in the environment or a Nextflow secret, never on a command line
- VEP cache and plugins staged as inputs; the gcp profile runs tasks on Google Batch

Deployment
- the API serves /api (matching the ingress); the web app reads its API URL at runtime
- migrations run in an init container under a Postgres advisory lock
- terraform: custom VPC shared with Batch, private Cloud SQL, API enablement, Workload
  Identity bindings, Secret Manager, deletion protection
- serverless track, now the default: Cloud Run services scaling to zero, a Cloud Run job
  for the Nextflow driver, and Neon or Cloud SQL behind one DATABASE_URL secret. GKE and
  Argo remain, behind -var deploy_kubernetes=true. See docs/cloud.md.

Correctness and security
- 409 on duplicate sample names, 422 on bad paging, natural chromosome ordering, wider
  VEP text columns, enum dropped on downgrade, the sample's assembly actually used
- vcf_uri restricted to gs:// objects or files under the data root, blocking option injection
- CORS restricted to configured origins; `make down` no longer deletes volumes

Data
- docs/data.md records the peer-reviewed, openly licensed sources (GIAB HG002, ClinVar,
  gnomAD) with citations and an honest evaluation plan; `make data` fetches a chr22 slice

Verified: api 50 tests, ml 18, loader 16, web 12; ruff, mypy, svelte-check, terraform
validate and both kustomize overlays clean.

api/tests/conftest.py

@@ -0,0 +1,83 @@
+"""Test bootstrap.
+
+CI provides DATABASE_URL (a Postgres service container). Locally, when it is unset, a throwaway
+Postgres is started with `pgserver` so `pytest` needs no Docker. Set REQUIRE_DB=1 to turn a missing
+database into a failure instead of a skip (CI does this).
+
+DATABASE_URL must be settled before anything imports `app`, because `app.config.settings` and the
+engine in `app.db` are created at import time.
+"""
+import os
+import tempfile
+from collections.abc import AsyncIterator, Iterator
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+if TYPE_CHECKING:
+    from alembic.config import Config
+
+API_DIR = Path(__file__).resolve().parents[1]
+_pg_server = None  # keeps the pgserver handle alive for the whole session
+
+
+def _resolve_database_url() -> str | None:
+    global _pg_server
+    if url := os.environ.get("DATABASE_URL"):
+        return url
+    try:
+        import pgserver
+    except ImportError:
+        return None
+    _pg_server = pgserver.get_server(tempfile.mkdtemp(prefix="rarelens-pg-"), cleanup_mode="delete")
+    socket_dir = _pg_server.get_uri().split("host=", 1)[1]
+    return f"postgresql+asyncpg://postgres@/postgres?host={socket_dir}"
+
+
+DATABASE_URL = _resolve_database_url()
+if DATABASE_URL:
+    os.environ["DATABASE_URL"] = DATABASE_URL
+
+
+@pytest.fixture(scope="session")
+def alembic_cfg() -> "Config":
+    if not DATABASE_URL:
+        if os.environ.get("REQUIRE_DB"):
+            pytest.fail("REQUIRE_DB is set but no database is available")
+        pytest.skip("no DATABASE_URL and pgserver is not installed")
+    from alembic.config import Config
+
+    cfg = Config(str(API_DIR / "alembic.ini"))
+    cfg.set_main_option("script_location", str(API_DIR / "alembic"))
+    return cfg
+
+
+@pytest.fixture(scope="session")
+def migrated_db(alembic_cfg: "Config") -> Iterator[None]:
+    from alembic import command
+
+    command.upgrade(alembic_cfg, "head")
+    yield
+
+
+@pytest.fixture
+async def db(migrated_db: None) -> AsyncIterator[None]:
+    from sqlalchemy import text
+
+    from app.db import engine
+
+    async with engine.begin() as conn:
+        await conn.execute(
+            text("TRUNCATE samples, jobs, variants, predictions RESTART IDENTITY CASCADE")
+        )
+    yield
+
+
+@pytest.fixture
+async def client() -> AsyncIterator[AsyncClient]:
+    from app.main import app
+
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
+        yield c