feat(pipeline): VEP database mode, and a pipeline-specific database URL

Makes a real annotation runnable locally without the 25 GB VEP cache, which is what
the demo needs and what a reviewer can reproduce in minutes.

- params.vep_database (VEP_DATABASE=true) queries Ensembl's public database instead of
  a local cache. Slower per variant and fewer fields, so --everything is swapped for the
  flags the loader actually stores. Its cache placeholder is NO_CACHE, not NO_FILE:
  Nextflow rejects two staged inputs sharing a filename.
- PIPELINE_DATABASE_URL is handed to the pipeline when set. The loader runs inside a
  container, where the API's own localhost URL would point at the container itself.
- README: how to run the UI's annotate button locally against host Nextflow + Docker.

Verified end to end on pipeline/tests/data/tiny.vcf: bcftools norm split the multiallelic
record, VEP 113 annotated 4 variants live, the loader wrote them and marked the job
succeeded, and the UI shows them. The deletion came back as 22:42126611 CT>C with exact
VCF alleles, which is the case the audit's ID-tagging fix exists for.

Tests: api 51, loader 16, stub run 3/3; ruff, mypy clean.

pipeline/main.nf

@@ -14,7 +14,10 @@ workflow {
     def must_exist = !workflow.stubRun
 
     vcf_ch  = Channel.fromPath(params.vcf, checkIfExists: true)
-    cache   = file(params.vep_cache, checkIfExists: must_exist)
+    // In database mode there is no cache to stage. Its placeholder differs from the plugin one:
+    // Nextflow rejects two staged inputs that share a filename.
+    cache   = file(params.vep_database ? "${projectDir}/assets/NO_CACHE" : params.vep_cache,
+                   checkIfExists: must_exist && !params.vep_database)
     plugins = file(params.vep_plugin_data ?: "${projectDir}/assets/NO_FILE", checkIfExists: must_exist)
 
     NORMALISE(vcf_ch)