feat(pipeline): VEP database mode, and a pipeline-specific database URL

Makes a real annotation runnable locally without the 25 GB VEP cache, which is what
the demo needs and what a reviewer can reproduce in minutes.

- params.vep_database (VEP_DATABASE=true) queries Ensembl's public database instead of
  a local cache. Slower per variant and fewer fields, so --everything is swapped for the
  flags the loader actually stores. Its cache placeholder is NO_CACHE, not NO_FILE:
  Nextflow rejects two staged inputs sharing a filename.
- PIPELINE_DATABASE_URL is handed to the pipeline when set. The loader runs inside a
  container, where the API's own localhost URL would point at the container itself.
- README: how to run the UI's annotate button locally against host Nextflow + Docker.

Verified end to end on pipeline/tests/data/tiny.vcf: bcftools norm split the multiallelic
record, VEP 113 annotated 4 variants live, the loader wrote them and marked the job
succeeded, and the UI shows them. The deletion came back as 22:42126611 CT>C with exact
VCF alleles, which is the case the audit's ID-tagging fix exists for.

Tests: api 51, loader 16, stub run 3/3; ruff, mypy clean.

api/tests/test_annotate.py

@@ -124,3 +124,28 @@ async def test_pubsub_failure_marks_the_job_failed(
     job = (await client.post(f"/api/samples/{sample_id}/annotate")).json()
     assert job["status"] == "failed"
     assert "403 denied" in job["log"]
+
+
+@pytest.mark.usefixtures("db")
+async def test_the_pipeline_gets_its_own_database_url(
+    client: AsyncClient, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The loader runs in a container, where the API's own localhost URL would point at itself."""
+    monkeypatch.setattr(settings, "pubsub_topic", None)
+    monkeypatch.setattr(settings, "cloudrun_job", None)
+    monkeypatch.setattr(
+        settings, "pipeline_database_url", "postgresql+asyncpg://u:[email protected]:5432/db"
+    )
+    monkeypatch.setattr(events.shutil, "which", lambda _: "/usr/bin/nextflow")
+    launched: dict[str, Any] = {}
+
+    async def fake_exec(*cmd: str, **kw: Any) -> FakeProcess:
+        launched["env"] = kw["env"]
+        return FakeProcess(0, b"")
+
+    monkeypatch.setattr(events.asyncio, "create_subprocess_exec", fake_exec)
+    sample_id = await new_sample(client)
+
+    await client.post(f"/api/samples/{sample_id}/annotate")
+    await events.drain()
+    assert launched["env"]["DATABASE_URL"] == "postgresql+asyncpg://u:[email protected]:5432/db"