epic: support external measure-bundle sources (Measure Repository Service + GitHub)

[michaelrobertsutton]

Context

From Bill Lakenan's 2026 May HL7 FHIR Connectathon and Working Group Meeting feedback: "I think it would be neat to add support for external measure repositories as well as using GitHub as a source for measures and/or measure bundles."

Today the only bundle ingress is POST /validation/upload-bundle (multipart file upload) at backend/app/routes/validation.py:59. backend/app/services/bundle_loader.py uses httpx only to push bundles into the local CDR — no external fetch path exists. Greenfield.

Two flavors to support

1. HL7 Measure Repository Service — point Lenny at a remote MRS endpoint, browse available measures, and import.
2. GitHub as source — point Lenny at a GitHub repo or raw file URL, fetch and import bundle(s).

Child tickets

• feat: load measure bundles from a GitHub repository URL #336 — GitHub MVP (load measure bundles from a GitHub repository URL)
• Measure Repository Service support: later child

Open questions

• Auth model (GitHub tokens for private repos, MRS auth schemes)?
• Caching / update strategy when a remote bundle changes?
• Versioning — how does Lenny handle importing a newer version of a measure already loaded?
• UI placement — Measures page or Settings?

References

• backend/app/routes/validation.py:59
• backend/app/services/bundle_loader.py