Enable Modal memory snapshots on household API worker

[hua7450]

Fixes #1527

Summary

Enables Modal memory snapshots on the household API worker to drop cold-start latency from ~45s to a few seconds. Implements Option B from the issue's implementation-choice comment — convert the worker to a @app.cls with an @modal.enter(snap=True) hook so the heavy Flask import runs at snapshot creation time, not on every cold start.

Changes

• policyengine_household_api/modal_release/worker_app.py — convert handle_household_request from a top-level @app.function to a method on a HouseholdWorker class decorated with @app.cls. The new load_flask_app method uses @modal.enter(snap=True) so the policyengine_household_api.api import (which pulls in policyengine_us, policyengine_uk, etc.) executes once at snapshot creation. Add enable_memory_snapshot=True to worker_function_options so it applies to all Modal environments.
• policyengine_household_api/modal_release/gateway.py — call_worker_function now resolves the worker via modal.Cls.from_name(app_name, "HouseholdWorker") and invokes .handle_household_request.remote(payload).
• docs/engineering/skills/modal-release-prs.md — update the Request Routing section to refer to HouseholdWorker.handle_household_request rather than the old bare function name.
• tests/unit/modal_release/test_worker_app.py — add two tests: one asserts enable_memory_snapshot=True is set for every Modal environment, one verifies the class exposes both the snapshot hook and the method entrypoint.
• changelog.d/1527.changed.md — Towncrier fragment.

Why a class instead of just adding the flag to the function?

enable_memory_snapshot=True only captures whatever's in memory at the time Modal takes the snapshot. With the previous shape:

def handle_household_request(payload):
    configure_google_credentials()
    from policyengine_household_api.api import app as flask_app   # heavy import, deferred
    return dispatch_to_flask_app(flask_app, payload)

the heavy import was deferred until first invocation, so Modal would have snapshotted a near-empty state and the first call on every cold container would still pay ~45s. Hoisting the import to module top-level would technically work but mixes "what's snapshotted" with "what runs per call" in a way that's easy to break. The Modal-idiomatic pattern — @app.cls + @modal.enter(snap=True) — makes the boundary explicit: anything assigned to self inside the snap hook is captured in the snapshot, anything in @modal.method bodies runs per invocation. configure_google_credentials() stays per-call (it should be), the Flask app load goes into the snapshot (it should).

Expected impact

Metric	Before	After
Cold-start init time	~45s (full import + CountryTaxBenefitSystem() chain)	~2-5s (memory snapshot restore)
Worst-case observed wall-clock for a partner-facing cold request	85.8s (real gateway log measurement from 2026-05-15)	~5-10s expected
Concurrency-burst tail (P99 in scale-out events)	up to ~56s (real log measurement)	~5-10s expected
Storage cost	n/a	~$0.30-1/month for the snapshot
Steady-state compute spend	baseline	strictly lower (no repeated 45s import billing)

Complements (does not overlap with) #1525, which keeps a warm pool of 3 containers in production. This PR makes the cold starts that do still happen — concurrency bursts, deploys, staging, after scale-down — fast.

Local checks

• make format-check → clean (128 files already formatted).
• Full unit test suite (.github/scripts, tests/to_refactor, tests/unit) → 419 passed.
• The two new tests in tests/unit/modal_release/test_worker_app.py pass.

Verification plan after merge (staging-first)

1. Deploy to the staging Modal environment.
2. Wait for the worker app to scale to zero (modal app list shows 0 containers).
3. Stream the worker log: modal app logs <worker-app-name> --timestamps.
4. Fire one calculate request.
5. Confirm:
   • Worker log shows snapshot restore (a single short line) rather than the full authlib -> Initialising API -> API initialised sequence.
   • Gateway log shows the first request's duration: in single-digit seconds, not 40-85s.
   • Parity against GCP household-api remains exact (no numerical regression from frozen snapshot state).
6. If staging looks good, promote to main per the usual release workflow.

Out of scope

• Setting min_containers / warm pool (already implemented in Keep production Modal workers warm #1526, addressing Keep production Modal household API workers warm #1525).
• Per-container concurrency tuning (needs Flask app thread-safety review — separate work).
• WSGI background-thread leak on container shutdown (separate minor issue noticed in gateway logs).

Test plan

• Lint passes (make format-check)
• Full unit test suite passes locally
• CI passes on this PR
• Staging deploy verifies cold-start latency drop (manual, post-merge)
• GCP parity test (sequential + burst) confirms no numerical regression on snapshotted state