Delegate DEER expand() to RERUM /gog/id/:_id

[thehabes]

Summary

Delegates DEER's client-side expand() to the new server-side /gog/id/:_id endpoint, so the Gallery of Glosses list no longer expands hundreds of Glosses in the browser or caches them in localStorage. This is the front-end half of the coordinated fix for #310 ("Too Many Glosses for localStorage").

Paired back-end PR: CenterForDigitalHumanities/rerum_server_nodejs#280.

Problem

glosses.html expands every Gloss on the client — fetch the object, POST /query for its targeting Annotations, then merge. That took 6–10 minutes, so results were cached in localStorage (expandedEntities), which overflowed the quota (QuotaExceededError) and stopped the list mid-load. #310 chooses to expand on the server behind a stable, browser-cacheable URL and have the client accept the finished object without re-expanding.

Changes

• UTILS.getExpandedURL(uri) (js/deer-utils.js): builds <host>/gog/id/<id> — rebuilding the id against the configured store (DEER.URLS.BASE_ID) and stripping the /v1 API prefix, since /gog lives at the server root — so it resolves in every environment (local and production) and works whether the object is keyed by @id or id. Returns null for non-RERUM URIs.
• UTILS.expand() (js/deer-utils.js) now fetches that URL and returns the finished object as-is — no findByTargetId, no client-side merge. It falls back to the legacy client-side expand for non-RERUM URIs, or if the endpoint is unavailable (e.g. not yet deployed) or returns a non-OK response.
• Hide the "reload the data" notice + button for now (js/deer-config.js ×3, js/deer-render.js): the .cachedNotice (which holds the .newcache refresh link) is set to display: none in the managed-list templates. With expansion now served behind a 24h HTTP cache, the old localStorage-based refresh affordance no longer does what it implies, so it is hidden until the refresh UX is reworked.

Because the change lives in the shared expand(), the whole app benefits (gloss list, gloss-metadata, manuscripts, witnesses). The stable per-object URL is browser-cached for 24h, so first load is N cacheable GETs with no per-Gloss POST /query, and subsequent visits are served from cache.

Notes and follow-ups

• The .cachedNotice/.newcache "reload the data" affordance is hidden (not removed). When it comes back it should bust the browser HTTP cache for the per-object /gog/id/:_id URLs so a refresh actually pulls fresh data.
• Remove the now-redundant in-memory expandedEntities cache plumbing.