Port /data/orthology and /data/orthologies to node; 405 and RFD header on every ported endpoint

[adamjohnwright]

The species selector's two orthology calls now come from node:

• GET /data/orthology/{id}/species/{speciesId}: one object's counterpart in a species.
• POST /data/orthologies/ids/species/{speciesId}: up to twenty ids, as a map.

graph-core's Cypher runs as written, and the domain serialiser writes each object in Java's views.

Matching Java

Everything below was measured against Java and is covered by a test:

• Species. It is a Spring Long path variable. Hex, +, leading zeros and spaces anywhere are accepted. A blank species is Java's 500 "converted to null"; any other bad value is a 400 naming the text. The Integer parsers now take a bit width, so Long shares their code.
• GET errors.
  • An id that is neither a stable id nor a dbId is a 404 naming it.
  • An id with no counterpart is the controller's 500 with a null message.
  • A dbId past a long is a 500.
• POST checks, in Java's order: the content type (415, with MimeTypeUtils' messages), then the species, then the body (422).
• POST body.
  • It is split on , ; \n \t the way String.split does it.
  • Past twenty ids, the first twenty go into a HashSet.
  • The answer is written in Java's HashMap order; JavaHashMap reproduces it, resizes included.
  • writeDomain can now write a map, so @id numbering runs across the values, as Jackson does in one write.
• Declared difference: . is not found here; Java's split throws a 500.

Two gaps on every ported endpoint

• nginx sends every method to node, and until now a POST to a GET route got Express's HTML 404. It now gets Java's 405 envelope.
• Spring adds Content-Disposition: inline;filename=f.txt when the last segment ends in an extension it does not trust. That includes a versioned id such as R-HSA-69620.5. rfd-snapshot.json holds the trusted extensions, generated from the deployed spring-web and Tomcat tables by snapshot-rfd.mjs.

Checked

• Against Java on a local node: 52 cases, covering GET, POST, every error, the views, JSOG, more than twenty ids and the 405s. All are identical apart from where one header sits in the list.
• Diff harness: it now fills a second path variable and sends POST bodies.
• Mutation checks: each new test fails under a mutation of the code it covers. Examples: map in insertion order, no resize, trailing empties kept, any content type, a 32-bit species, no 405.

🤖 Generated with Claude Code