feat(ml-api): add model registry and GET /model-info

[pavsoss]

Summary

The served model was opaque — no way to see which artifacts are live, their checksums, or when they were trained. This adds a lightweight registry.

• A registry module fingerprints each artifact (sha256, size, mtime) and reads an optional model_card.json (trained_at, metrics, labels) when present.
• The serving snapshot carries this metadata and refreshes it on every reload.
• A public GET /model-info returns {version, checksums, metadata}, documented in the OpenAPI spec.

Additive: no existing endpoint or response changes.

Test plan

Unit coverage for the fingerprinting (checksums are stable and change only when an artifact changes) plus a /model-info shape check.

Part 1/2 of #1007.

[vercel]

@pavsoss is attempting to deploy a commit to the Aditya Sharma's projects Team on Vercel.

A member of the Team first needs to authorize it.