Expose a supported core interface for the Flask server #3740

Part of #3737.

The Flask applications currently import shared functionality from private mock_vws modules, including request/response helpers, validators, database matching, query tools, and Model Target/reco-count API logic. Establish the supported core interface needed by the server before moving it to another repository.

Acceptance criteria:

• Audit the Flask VWS, VWQ, and target-manager imports and identify the smallest shared interface the server actually needs.
• Expose that interface through documented, typed public imports. Keep shared models, validation, and API behavior owned by core; avoid copying logic into the server or exporting unrelated internals.
• Update the existing Flask implementation to use the supported imports while it still lives in this repository.
• Preserve existing MockVWS public behavior and demonstrate that in-memory and Flask contract tests still pass under existing coverage requirements.
• Document compatibility expectations for server consumers and retain tests of the public interface's meaningful behavior.
• Audit dependency ownership. Moving Flask should allow its direct dependency to leave core when unused; retain dependencies that shared code still needs, such as Werkzeug's multipart parsing, unless separately refactored.

Completion point: the Flask implementation can consume shared logic through supported core imports. This can proceed independently of the test-packaging work; the actual repository extraction is separate.