feat(ml): train a real model, and report the number that matters rather than the flattering one

"Variants are unscored" was accurate: nothing was ever trained, so a quarter of every rank was
dead weight and the UI leaked a connection error at the reader.

- scripts/make-training-set.sh derives a training table from ClinVar directly. ClinVar already
  carries the molecular consequence, the gene and an allele frequency, which is the feature set
  serving sends, so this avoids running VEP over hundreds of thousands of variants. 2-star
  records only.
- train.py now holds out whole genes (GroupShuffleSplit). docs/data.md had said to do this since
  the data pass; the code was still doing a random split, which is the leak Grimm 2015 describes.
- evaluate() reports missense on its own. On the last run: AUROC 0.986 over 74,239 held-out
  variants, but 0.872 over the 13,553 missense ones, and the docs say plainly why even that is
  flattered — within missense the only live feature is allele frequency, and ClinVar's benign
  calls often use allele frequency as evidence (ACMG BA1/BS1), so the feature partly caused the
  label.
- the 503 now names what is missing (model@alias via tracking URI) and leaves the exception in
  the server log instead of the UI.
- make training-set / make train; the 58 MB table is gitignored.

Verified end to end: model registered as v2, the simulated NF2 case scores 0.999 on the planted
variant, and it now ranks 1.00 with all four components live.

Tests: api 77, ml 22, loader 16, web 32; ruff, mypy, svelte-check clean.

Makefile

@@ -1,6 +1,7 @@
-.PHONY: up down clean migrate test lint data hpo demo-case loader pipeline annotate images kind serverless-deploy serverless-destroy gcp-configure gcp-secrets
+.PHONY: up down clean migrate test lint data hpo demo-case training-set train loader pipeline annotate images kind serverless-deploy serverless-destroy gcp-configure gcp-secrets
 
 VCF ?= data/example.vcf.gz
+MLFLOW_URI ?= http://localhost:5001
 TAG ?= latest
 # The loader container reaches docker-compose's Postgres through the host.
 HOST_DB_URL ?= postgresql://rarelens:[email protected]:5432/rarelens
@@ -36,6 +37,13 @@ hpo:  ## load HPO gene-to-phenotype annotations, which the ranking matches again
 demo-case:  ## build the simulated proband: GIAB background + one ClinVar pathogenic variant
 	scripts/make-demo-case.sh
 
+training-set:  ## build a ClinVar training table, shaped like VEP --tab output
+	scripts/make-training-set.sh
+
+train: ## train the pathogenicity model and point the production alias at it (needs `make up`)
+	cd ml && MLFLOW_TRACKING_URI=$(MLFLOW_URI) uv run --extra dev \
+		python -m rarelens_ml.train --tsv ../data/clinvar-training.vep.tsv --register
+
 loader:
 	docker build -t rarelens/loader:dev -f pipeline/loader.Dockerfile pipeline