feat(deploy): a Railway deployment of the analysed cases, behind one credential

Three services -- Postgres, API, UI -- with the API on Railway's private
network only, so the UI's /api proxy is the single public entry point and
there is no CORS.

The pipeline cannot run there. Nextflow shells out to `docker run` for VEP
and bcftools, and Railway gives you a container, not a Docker daemon. Rather
than leave a button that always fails, cases are annotated locally and copied
up by scripts/seed-remote.sh, and PUBLIC_PIPELINE_ENABLED=false hides the
analyse/score actions and the create-case form.

DATABASE_IDLE_CONNECTIONS=false is what makes idling work. Railway decides a
service is idle from its *outbound* traffic and sleeps it after ~5-10 minutes;
a pooled database connection is outbound traffic, so SQLAlchemy's default pool
would have kept the API awake and billable for ever. Setting it false switches
to NullPool, which costs a connection per request -- nothing at demo traffic,
the wrong trade under real load, hence the flag rather than a rewrite.

BASIC_AUTH_USER / BASIC_AUTH_PASSWORD put one shared credential in front of
the site. Nothing deployed is patient data, so this stops the URL being
wandered into rather than protecting anyone's privacy; unset, the site is
open, which is what local development wants. Compared in constant time, and
both halves of the credential are checked even when the first fails.

api/app/config.py

@@ -32,6 +32,12 @@ class Settings(BaseSettings):
     local_data_root: Path = Path("/data")
     # Browsers calling the API cross-origin; behind the ingress the UI is same-origin.
     cors_origins: list[str] = ["http://localhost:5173"]
+    # Whether to keep pooled database connections open between requests. Set it false on a host
+    # that sleeps idle containers to save money -- Railway's serverless mode decides a service is
+    # idle from its *outbound* traffic, and a held connection is outbound traffic, so a pool keeps
+    # the service awake and billable forever. Costs a connection setup per request, which is
+    # nothing at demo traffic and the wrong trade under real load.
+    database_idle_connections: bool = True
 
 
 settings = Settings()