Add timeouts to request-path external calls and reuse per-process clients #886

Problem

The request path makes external calls with no timeout and rebuilds expensive clients on every request.

• lib/external_publications.py:261 and :561 call requests.get with no timeout.
• lib/orcid.py:21 and :54 build an orcid.PublicAPI client per call, with no timeout.
• deps.py:31 and :35 build the HGVS data provider and a SeqRepo on every request. Gene autocomplete runs a UTA query per call.

A stalled upstream holds a threadpool slot and a database connection until the load balancer gives up.

Scope

• Route the publication and ORCID calls through the default-timeout session in lib/http.py from Worker outbound calls have no timeout #883, with a timeout constant per service.
• Build the HGVS data provider and SeqRepo once per process and reuse them.
• Cache gene autocomplete results.

Acceptance criteria

• Tests assert the timeout each request-path call passes.
• A test asserts two requests get the same data provider instance.
• ruff S113 passes on src/mavedb/lib and src/mavedb/routers.