Update broker endpoints

[emilylm]

📌 Summary

This PR updates and restructures the Canopy broker API endpoints to support a cleaner separation between resolved accessions (what Canopy already knows) and required accessions (what a given entity depends on before it can be submitted). It also improves prerequisite propagation across the submission chain, adds better error handling for duplicate accession reporting, and normalises FK references for submission objects.

---

🔄 Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Refactor (code change that neither fixes a bug nor adds a feature)
• 📚 Documentation update
• ⚙️ CI / build / tooling change

---

🧩 Key Changes

• Restructured broker contract endpoints — /claims/ready, /claims/entity, /validation, and /reports/{attempt_id} updated to align with the broker client's expected contract
• Prerequisite accession split — claim responses now distinguish between resolved accessions (from DB / accession registry) and required_* accessions (what this entity needs to proceed), giving broker clients full dependency visibility before submission
• Simplified report endpoint — /broker/reports/{attempt_id} now only requires attempt_id as a path parameter (removed body requirement)
• organism_part default — specimen samples now default organism_part to WHOLE ORGANISM instead of leaving it unset
• DB migration — adds project_id FK directly to sample_submission table (with backfill from the organism's genomic data project) for normalised lookups
• Improved error handling — returns a meaningful error when reporting entities whose accessions already exist in the accession registry
• Default values moved from DB schema into application code for easier maintenance

---

✅ Checklist

• Tests are passing locally / in CI
• New tests have been added for new or changed functionality
• Self-review completed
• Documentation updated (if needed)
• No sensitive data or secrets included

---

🔍 Review Notes

• The required_* prerequisite fields in claim responses are a contract change — broker clients will need to be updated to read these fields (this broker repo has been updated accordingly on the broker side)
• ~The DB migration backfills project_id on existing sample_submission rows ~ -> have removed this complexity since we are not in prod yet.
• The report endpoint path change (attempt_id now path-only) is a breaking change for any existing callers

---

📎 Related Issues / Tickets

• Closes #
• Related to #