Protect the lean variant view like the CSV download routes #904

Summary

When the allele data model branch (RT) ships, the score set page's charts and the variant page stop downloading CSVs and read the lean variant view instead. That route builds a whole score set in one response too, but none of the protections added for the CSV routes cover it: the per-process build cap, the longer statement limit and the WAF download limit. This issue extends them, so a script can't stall the site through the lean view. RT is explained in the glossary on #808.

Routes

• GET /score-sets/{urn}/variants, the lean view (get_score_set_lean_variants in routers/score_sets.py)
• GET /score-sets/{urn}/variant-details, the NDJSON export

Scope

• Wrap each build in the CSV build slot, sized by the score set's variant count, the same way as the CSV routes.
• Apply the 45-second statement limit if the lean view's query exceeds 30 seconds on the largest score set in staging.
• Add both paths to the WAF download rule's scope, on staging then prod. Match with a regex such as ^/api/v1/score-sets/[^/]+/(variants|variant-details)$. A plain ends-with /variants would also catch the score calibration routes.
• Mention both routes in the Quickstart's Rate Limits section.

Converting the route to def is part of #881. Making the lean view itself fast is #451.

Acceptance criteria

• With every build slot held, a lean view request for a large score set returns 503 with Retry-After, and one for a small score set succeeds.
• The staging WAF blocks the lean view after 100 requests in 5 minutes from one IP, and doesn't block /score-calibrations/{urn}/variants.
• The score set page for urn:mavedb:00000053-a-1 loads in staging when nothing else is building.