feat(ml): train a real model, and report the number that matters rather than the flattering one

"Variants are unscored" was accurate: nothing was ever trained, so a quarter of every rank was
dead weight and the UI leaked a connection error at the reader.

- scripts/make-training-set.sh derives a training table from ClinVar directly. ClinVar already
  carries the molecular consequence, the gene and an allele frequency, which is the feature set
  serving sends, so this avoids running VEP over hundreds of thousands of variants. 2-star
  records only.
- train.py now holds out whole genes (GroupShuffleSplit). docs/data.md had said to do this since
  the data pass; the code was still doing a random split, which is the leak Grimm 2015 describes.
- evaluate() reports missense on its own. On the last run: AUROC 0.986 over 74,239 held-out
  variants, but 0.872 over the 13,553 missense ones, and the docs say plainly why even that is
  flattered — within missense the only live feature is allele frequency, and ClinVar's benign
  calls often use allele frequency as evidence (ACMG BA1/BS1), so the feature partly caused the
  label.
- the 503 now names what is missing (model@alias via tracking URI) and leaves the exception in
  the server log instead of the UI.
- make training-set / make train; the 58 MB table is gitignored.

Verified end to end: model registered as v2, the simulated NF2 case scores 0.999 on the planted
variant, and it now ranks 1.00 with all four components live.

Tests: api 77, ml 22, loader 16, web 32; ruff, mypy, svelte-check clean.

README.md

@@ -75,10 +75,13 @@ would be the container itself. `LOCAL_DATA_ROOT` is the directory a sample's `vc
 To train and register a model (the API scores with `models:/rarelens-pathogenicity@production`):
 
 ```bash
-cd ml && MLFLOW_TRACKING_URI=http://localhost:5000 \
-  uv run python -m rarelens_ml.train --tsv ../pipeline/results/<sample>.vep.tsv --register
+make training-set   # a ClinVar-derived training table, ~370k labelled variants
+make train          # fits, reports held-out metrics by gene split, moves the production alias
 ```
 
+What those metrics do and do not mean is in [docs/data.md](docs/data.md); the headline AUROC
+flatters a model whose strongest feature is the consequence class.
+
 Local Kubernetes: `make kind` builds the images, loads them into a kind cluster and applies
 `infra/k8s/overlays/local`.