fix: overhaul the platform skeleton, add a serverless deployment track

An end-to-end audit found the repo could not build, test or run as shipped. This
fixes every finding, then adds a Cloud Run track so the demo costs about £1/month
idle instead of ~£150.

CI (red on its first run)
- api: setuptools could not build the package (flat layout with app/ and alembic/)
- web: missing @types/node; `vitest run` exited 1 with no test files
- pipeline: the stub run needed a gitignored VCF, and no process had a stub block
- ruff pinned, mypy configured, DB tests on real Postgres (pgserver locally, service in CI)

ML serving (scores were meaningless)
- the registered model now carries its own feature engineering and returns predict_proba,
  so serving sends raw columns and cannot drift from training
- resolve by registry alias (stages are deprecated in MLflow 3) and record the real
  version; re-scoring upserts instead of failing on the unique constraint
- ClinVar labels parsed from VEP's lowercase terms

Pipeline
- exact ref/alt recovered from a CHROM_POS_REF_ALT VCF ID; loading is idempotent
- job status reaches running/failed/succeeded, so the UI stops polling dead jobs
- DATABASE_URL travels in the environment or a Nextflow secret, never on a command line
- VEP cache and plugins staged as inputs; the gcp profile runs tasks on Google Batch

Deployment
- the API serves /api (matching the ingress); the web app reads its API URL at runtime
- migrations run in an init container under a Postgres advisory lock
- terraform: custom VPC shared with Batch, private Cloud SQL, API enablement, Workload
  Identity bindings, Secret Manager, deletion protection
- serverless track, now the default: Cloud Run services scaling to zero, a Cloud Run job
  for the Nextflow driver, and Neon or Cloud SQL behind one DATABASE_URL secret. GKE and
  Argo remain, behind -var deploy_kubernetes=true. See docs/cloud.md.

Correctness and security
- 409 on duplicate sample names, 422 on bad paging, natural chromosome ordering, wider
  VEP text columns, enum dropped on downgrade, the sample's assembly actually used
- vcf_uri restricted to gs:// objects or files under the data root, blocking option injection
- CORS restricted to configured origins; `make down` no longer deletes volumes

Data
- docs/data.md records the peer-reviewed, openly licensed sources (GIAB HG002, ClinVar,
  gnomAD) with citations and an honest evaluation plan; `make data` fetches a chr22 slice

Verified: api 50 tests, ml 18, loader 16, web 12; ruff, mypy, svelte-check, terraform
validate and both kustomize overlays clean.

infra/terraform/iam.tf

@@ -1,6 +1,7 @@
 # Workload Identity Federation: GitHub Actions pushes images without long-lived keys.
 resource "google_iam_workload_identity_pool" "github" {
   workload_identity_pool_id = "github"
+  depends_on                = [google_project_service.enabled]
 }
 
 resource "google_iam_workload_identity_pool_provider" "github" {
@@ -29,22 +30,66 @@ resource "google_artifact_registry_repository_iam_member" "ci_push" {
   member     = "serviceAccount:${google_service_account.ci.email}"
 }
 
-# Runtime identities (bound to k8s ServiceAccounts via GKE Workload Identity)
-resource "google_service_account" "api"      { account_id = "rarelens-api" }
+# Runtime identities, bound to Kubernetes ServiceAccounts in namespace "rarelens" via GKE
+# Workload Identity (the gcp overlay annotates the k8s side).
+resource "google_service_account" "api" { account_id = "rarelens-api" }
 resource "google_service_account" "pipeline" { account_id = "rarelens-pipeline" }
 
+resource "google_service_account_iam_member" "api_workload_identity" {
+  count              = var.deploy_kubernetes ? 1 : 0
+  service_account_id = google_service_account.api.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project}.svc.id.goog[rarelens/rarelens-api]"
+}
+
+resource "google_service_account_iam_member" "pipeline_workload_identity" {
+  count              = var.deploy_kubernetes ? 1 : 0
+  service_account_id = google_service_account.pipeline.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project}.svc.id.goog[rarelens/rarelens-pipeline]"
+}
+
 resource "google_project_iam_member" "api_sql" {
   project = var.project
   role    = "roles/cloudsql.client"
   member  = "serviceAccount:${google_service_account.api.email}"
 }
-resource "google_project_iam_member" "api_pubsub" {
-  project = var.project
-  role    = "roles/pubsub.publisher"
-  member  = "serviceAccount:${google_service_account.api.email}"
+
+resource "google_pubsub_topic_iam_member" "api_publish" {
+  topic  = google_pubsub_topic.vcf_uploaded.name
+  role   = "roles/pubsub.publisher"
+  member = "serviceAccount:${google_service_account.api.email}"
 }
+
+resource "google_pubsub_subscription_iam_member" "pipeline_subscribe" {
+  subscription = google_pubsub_subscription.vcf_uploaded_argo.name
+  role         = "roles/pubsub.subscriber"
+  member       = local.pipeline_sa_member
+}
+
 resource "google_storage_bucket_iam_member" "pipeline_data" {
   bucket = google_storage_bucket.data.name
   role   = "roles/storage.objectAdmin"
-  member = "serviceAccount:${google_service_account.pipeline.email}"
+  member = local.pipeline_sa_member
+}
+
+resource "google_artifact_registry_repository_iam_member" "pipeline_pull" {
+  repository = google_artifact_registry_repository.images.name
+  location   = var.region
+  role       = "roles/artifactregistry.reader"
+  member     = local.pipeline_sa_member
+}
+
+# Nextflow's google-batch executor submits Batch jobs that run as the pipeline SA itself.
+resource "google_project_iam_member" "pipeline_batch" {
+  for_each = toset(["roles/batch.jobsEditor", "roles/batch.agentReporter", "roles/logging.logWriter"])
+  project  = var.project
+  role     = each.value
+  member   = local.pipeline_sa_member
+}
+
+resource "google_service_account_iam_member" "pipeline_act_as_self" {
+  service_account_id = google_service_account.pipeline.name
+  role               = "roles/iam.serviceAccountUser"
+  member             = local.pipeline_sa_member
 }