Add read-only JHU dataset access for isolated local development

[projectsahmaddurrerehman-spec]

Local development currently risks using the production API, where some GET routes can lease inference jobs or generate meshes. This adds a separate authenticated service that exports only existing files for explicitly approved PanTS cases, plus a client that copies them to a new local snapshot and a launcher that uses a local database and output directories.

• Expiring, revocable, case-scoped bearer grants; exact asset and route allowlists; traversal/symlink checks; GET/HEAD only; bounded downloads and no redirects.
• Isolated local backend/frontend launchers discard inherited application credentials and disable backend dotenv loading. Vite proxies to the local backend.
• Dedicated systemd service and restricted SSH account templates, with administrator provisioning and approval instructions. No automatic JHU deployment, production app change, or production database migration.

Validation:

• All 29 new tests passed in Linux CI, including the symlink escape and Gunicorn entrypoint checks. Windows: 27 passed, with the two platform-dependent checks skipped. A fresh isolated environment passed pip check.
• Frontend type-check passed.
• Full local smoke passed with synthetic NIfTI data: export -> snapshot -> Alembic/local backend -> Vite dashboard/API proxy -> search and exact CT bytes. Source hashes were unchanged. The smoke processes were stopped afterward.

Deployment remains pending VPN access, approval of the exact merged revision, and a JHU administrator provisioning the dedicated OS/SSH accounts and validating the namespace restrictions. This version provides selected-case snapshots, not remote GPU inference or a whole-dataset mirror.

GitHub main is currently unprotected; the authenticated account has push permission but no admin permission. A repository administrator must configure required PR reviews/checks (and required environment reviewers before future deployment automation). Documentation explicitly distinguishes these pending settings from the implemented data boundary.