feat(deploy): a Railway deployment of the analysed cases, behind one credential

Three services -- Postgres, API, UI -- with the API on Railway's private
network only, so the UI's /api proxy is the single public entry point and
there is no CORS.

The pipeline cannot run there. Nextflow shells out to `docker run` for VEP
and bcftools, and Railway gives you a container, not a Docker daemon. Rather
than leave a button that always fails, cases are annotated locally and copied
up by scripts/seed-remote.sh, and PUBLIC_PIPELINE_ENABLED=false hides the
analyse/score actions and the create-case form.

DATABASE_IDLE_CONNECTIONS=false is what makes idling work. Railway decides a
service is idle from its *outbound* traffic and sleeps it after ~5-10 minutes;
a pooled database connection is outbound traffic, so SQLAlchemy's default pool
would have kept the API awake and billable for ever. Setting it false switches
to NullPool, which costs a connection per request -- nothing at demo traffic,
the wrong trade under real load, hence the flag rather than a rewrite.

BASIC_AUTH_USER / BASIC_AUTH_PASSWORD put one shared credential in front of
the site. Nothing deployed is patient data, so this stops the URL being
wandered into rather than protecting anyone's privacy; unset, the site is
open, which is what local development wants. Compared in constant time, and
both halves of the credential are checked even when the first fails.

web/src/routes/cases/[id]/+page.svelte

@@ -3,6 +3,7 @@
   import { api, type Candidate, type CandidatePage, type Case, type Job, type VariantDetail } from '$lib/api';
   import { poll } from '$lib/poll';
   import { formatElapsed, latestStep } from '$lib/progress';
+  import { env } from '$env/dynamic/public';
   import { missingEvidenceNote, needsScoring, plural } from '$lib/candidates';
   import CandidateRow from '$lib/components/CandidateRow.svelte';
   import Funnel from '$lib/components/Funnel.svelte';
@@ -35,6 +36,9 @@
   // not need a five-minute re-run of VEP to get its score.
   const unscored = $derived(!!page && page.items.length > 0 && needsScoring(page.items, page.evidence));
   const evidenceNote = $derived(page ? missingEvidenceNote(page.evidence) : null);
+  // The deployed demo has no Nextflow and no Docker daemon to run VEP in, so the pipeline cannot
+  // run there. Hide the buttons rather than leave them to fail: the cases are already analysed.
+  const canAnalyse = env.PUBLIC_PIPELINE_ENABLED !== 'false';
 
   // Tick the elapsed time while a run is in flight; polling refreshes the step itself.
   $effect(() => {
@@ -160,9 +164,11 @@
   </p>
 {:else}
   <p class="actions">
-    <button onclick={analyse} disabled={busy}>{job ? 'Re-analyse case' : 'Analyse case'}</button>
-    {#if unscored}
-      <button class="quiet" onclick={scoreThenLoad}>Score variants</button>
+    {#if canAnalyse}
+      <button onclick={analyse} disabled={busy}>{job ? 'Re-analyse case' : 'Analyse case'}</button>
+      {#if unscored}
+        <button class="quiet" onclick={scoreThenLoad}>Score variants</button>
+      {/if}
     {/if}
     {#if page && page.funnel.total > 0}
       <a class="reportlink" href="/cases/{data.caseId}/report">Case report →</a>
@@ -219,7 +225,12 @@
   </div>
 {:else if page && !running}
   <div class="empty">
-    No results yet. "Analyse case" runs VEP over the VCF, scores each variant, then ranks what is
-    left against the phenotype.
+    {#if canAnalyse}
+      No results yet. "Analyse case" runs VEP over the VCF, scores each variant, then ranks what is
+      left against the phenotype.
+    {:else}
+      No results for this case. This deployment shows cases that were analysed beforehand; running
+      the pipeline needs Nextflow and a Docker daemon, which it does not have.
+    {/if}
   </div>
 {/if}