Security hardening: genes app

[davmlaw]

Fixes security findings from SACGF/variantgrid_private#3826 (private issue — low/medium severity, no immediately exploitable vulnerabilities).

Changes

• genes/panel_app.py — URL-encode gene symbol before appending to outbound PanelApp API URL (urllib.parse.quote) to prevent path/query manipulation in the external request
• genes/panel_app.py — On PanelApp 404, log the internal request URL server-side only; remove it from the user-facing error response to avoid leaking configured server URLs
• genes/views/views_rest.py — In CreateGeneListView, log gene list import errors server-side (log.exception) and return a generic message to the client instead of a full Python traceback (which could expose server filesystem paths)
• genes/views/views_rest.py — Add 1-hour cache_page to PanelAppGeneListView to throttle repeated outbound proxy requests
• genes/templates/genes/hotspot_graph.html — Replace eval() in hotspot graph click handler with window[fn] function dispatch (defence-in-depth against DOM-based XSS)

Exploitability notes

None of these findings are immediately exploitable by an authenticated attacker:

• The PanelApp URL injection only affects outbound requests to an external API (not SSRF — server URL is DB-managed)
• The traceback is only visible to the user who created their own gene list
• The eval() uses a hardcoded function name set in trusted server-side templates
• The PanelApp URL exposure reveals only a configured server base URL

All changes are safe to include in a public PR.