sprint: make Day-4 tests self-sufficient — 31/31 in CI without DVC data

[Mark007-R]

What

Replaces the previous "mark and skip" workaround (#30) with a proper fix: the Day-4 tests now construct synthetic fixtures instead of loading the real DVC-tracked artifacts. All 31 tests run in CI on a hermetic runner; nothing is deselected.

Before vs after

```

Before (#30): mark-and-skip

$ pytest tests/ -q -m "not requires_data"
26 passed, 5 deselected
```

```

Now: synthetic fixtures

$ pytest tests/ -q -m "not requires_data"
31 passed, 0 deselected
```

How

`tests/test_api.py`

The original fixture called `create_app()` with no args, which forced the FastAPI app to load `models/fraud_model.pkl` from disk. The rewrite:

1. Trains a 5-tree XGBoost on 200 random rows with 4 made-up feature columns (`f0`-`f3`) -- takes ~50 ms.
2. Wraps it in `src.serving.api.ModelBundle` (which is already part of the public API).
3. Passes the bundle to `create_app(bundle=...)` -- the create_app function has supported injected bundles since Day 4, just nobody used it.
4. Rewrites `_sample_features()` to generate a deterministic row matching the synthetic bundle's columns instead of slicing `X_test.csv`.

The four /healthz, /predict (valid), /predict (empty rejection), /metrics/predictions tests now run against the synthetic model.

`tests/test_data_loader.py`

`test_loader_reads_x_test_and_y_test` previously called `SentinelDataLoader()` with no args, which read from `data/processed/X_test.csv` via params.yaml. The rewrite:

1. Writes a 4-row `X_test.csv` + matching `y_test.csv` into `tmp_path/data/processed/`.
2. Builds a `LoaderConfig(project_root=tmp_path, use_dvc_pull=False)` so all paths resolve under tmp_path.
3. Asserts the loader returns the expected DataFrame/Series shape and label vocabulary.

The two other tests in the file (`test_loader_resolves_paths_from_params`, `test_dvc_status_is_safe_without_dvc`) were already self-sufficient and are unchanged.

Marker hygiene

`tests/conftest.py` still registers the `requires_data` marker, even though no test currently uses it -- it stays available for `tests/synthetic_drift.py` (the 30-day replay script that genuinely needs the full `data/processed/features.csv`) and any future genuinely-dataset-bound tests.

Verification

• `pytest tests/ -q -m "not requires_data" --ignore=tests/synthetic_drift.py` -> 31 passed, 0 deselected in 23.4 s on the dev host.
• No production code touched -- this PR is test-side only.

Result vs the original problem

#28 (Day 7 production wrap) added CI but exposed two latent issues. #29 fixed the install step (yanked protobuf). #30 was a defensive marker that skipped 5 tests. This PR removes the skip -- every test ships green on every push.