WIP: feat(backend, deployment): seed dev SeqSet-citation test data + curated-citation endpoint

[theosanderson]

WIP / do not merge. Stacked on top of #6304 (seqset-citations) — review/merge that first. This PR targets the seqset-citations branch, not main.

What this adds

Two related pieces on top of the SeqSet citation-tracking work:

1. Superuser-only endpoint to add curated citations (backend)

PR #6304 defines a CURATED citation origin in the DB but nothing writes it — only the scheduled CrossRef task inserts citations, which isn't reproducible on a dev cluster. This adds a real way to record a manual citation:

• POST /create-curated-citation (super-user only), body { seqSetId, seqSetVersion, source: { sourceDOI, title, year, contributors } }.
• Enforces isSuperUser (403 otherwise), validates the SeqSet version exists (404 otherwise), upserts the citation source by DOI (reusing an existing source row rather than clobbering, e.g. one already discovered via CrossRef), and links it to the SeqSet version. The link is by (seqset_id, seqset_version), so no minted DOI is required.
• Adds the SubmittedCuratedCitation request type, a test-client helper, and tests covering success, forbidden (non-super-user), not-found, and unauthorized cases. Backend tests pass locally.

2. Dev-only test-data seeder (deployment / integration-tests)

A Job that populates a fresh dev/E2E deployment so the SeqSet + citation feature is visibly exercised, reusing the existing integration-test Playwright page objects.

tests/seed.setup.ts logs in as the dev super user and, in one flow:

1. creates a submitting group,
2. bulk-submits a few dummy-organism sequences and releases them,
3. builds a SeqSet from the released accessions,
4. adds a curated citation via the new endpoint (authenticated with the logged-in access_token cookie).

It is idempotent (skips if the seed SeqSet already exists).

• The seed Playwright project is only registered when RUN_SEED=true, so normal test runs never trigger it.
• New integration-tests/Dockerfile runs npm run seed.
• templates/seed-test-data-job.yaml runs it as a Helm post-install/post-upgrade hook gated on seedTestData.enabled (off by default; on in values_e2e_and_dev.yaml), with an init container that waits for the website + backend. Helm hooks are honoured by both plain Helm and Argo CD.

Design notes and decisions are written up in integration-tests/seed/SPEC.md.

Validation

• Backend: ./gradlew test --tests CitationEndpointsTest passes; compiles + ktlint clean.
• Chart: helm lint (prod + dev values) and helm template pass; the Job renders only when enabled. Schema formatted with prettier.
• Integration-tests TS: tsc, prettier, eslint clean.

Not yet done (the WIP part)

The seeder is type-checked and the chart renders, but it has not been run end-to-end against a live cluster. Two assumptions to confirm there (both have a documented fallback in the SPEC):

• the dummy-organism bulk form accepts submissionId/date/country/pangoLineage;
• the website stores the Keycloak access token in an access_token cookie usable as a backend bearer token.

🤖 Generated with Claude Code

🚀 Preview: Add preview label to enable

[claude]

This PR may be related to: #6497 (Inconsistent use of the term 'Citation' in backend) — the new /create-curated-citation endpoint and associated types introduced here touch the same citation naming area flagged in that issue.