Measure where time and bytes go when serving whole score sets #914

Summary

Whole-set responses (score set CSVs, the lean variant view, variant details) are the API's most expensive requests. We don't know how their cost splits between the database, building and serializing rows, and transfer, how large they get, or who requests them how often. This investigation measures all of that. The results decide how these responses are cached and rate-limited, and whether per-row validation is worth removing.

What to find out

1. Time per phase. For urn:mavedb:00000053-a-1 and one score set of about 50k variants, profile GET /score-sets/{urn}/variants, GET /score-sets/{urn}/variant-details and the scores CSV with py-spy or pyinstrument against a staging-sized database. Phases: SQL execution, ORM loading, envelope assembly, Pydantic validation, JSON or CSV serialization, gzip, transfer. Record db_statement_count beside each run.
2. Body sizes. For the 20 largest public score sets, record each endpoint's response size, raw and gzipped.
3. Corpus size. Total bytes, raw and gzipped, to download every public score set once from each endpoint. This sizes the public data dump.
4. Request mix. From a month of request logs in CloudWatch, per whole-set route:
   • share of total API request time;
   • share of requests repeating a score set and parameters already requested in the previous 24 hours;
   • both split by UI traffic (Origin or Referer on the MaveDB site) versus other traffic, and by signed-in versus anonymous.

Origin and Referer can be forged, which is fine for measurement. They aren't used for enforcement.

What to produce

A comment with:

• a table per endpoint of time per phase, share of total and peak memory;
• the body-size table and the corpus totals;
• the request-mix numbers;
• a ranked list of changes, each linking an existing or new issue.

Acceptance criteria

• Phase timings are posted for all three endpoints on both score sets, with the profiles attached.
• Raw and gzipped sizes are posted for the 20 largest score sets on each endpoint.
• Corpus totals are posted per endpoint.
• Share of API time and the 24-hour repeat rate are posted per route, split by UI versus other and signed-in versus anonymous.