Extract score set domain logic from the router into services

[bencap]

Problem

routers/score_sets.py is about 2,800 lines, and its handlers mix HTTP handling with domain logic: creation, variant upload, publishing and supersession. The logic can only be tested through the routes, and the three long-lived branches conflict in this file.

Scope

• Move score set creation, publish and supersession logic into lib/score_sets/ service functions that take a session and the calling user and return domain objects.
• Handlers parse the request, call the service and build the response.
• Do this after the read-filter deletions in Delete the Python read filters #811, Delete association filter and narrowing sites in the collections router #812 and Delete remaining reached-path filters; resolve the publish-time chain walk #813, which rewrite the same handlers.

Acceptance criteria

• No handler in routers/score_sets.py is longer than about 40 lines.
• The services have unit tests that don't go through HTTP.
• Router tests pass unchanged.