fix(graphql): enforce query depth limit, alias caps, complexity budget and disable introspection in production

[mopxam-art]

Why

The GraphQL endpoint lacked query depth validation, alias fan-out bounds, and complexity analysis, allowing deeply nested selections or wide alias fan-out attacks to trigger excessive resolver executions and memory pressure. Additionally, schema introspection was unconditionally open across all environments.

What

• Added AST validation rules in src/graphql/validation.ts:
  • createDepthLimitRule: bounds nested field and fragment selection depth (default: 6, configurable via GRAPHQL_MAX_DEPTH).
  • createAliasLimitRule: caps total field aliases (default: 15, GRAPHQL_MAX_ALIASES) and root query selections (default: 10, GRAPHQL_MAX_ROOT_FIELDS).
  • createComplexityLimitRule: calculates execution budget factoring in list multipliers like projects(limit: N) (default budget: 500, GRAPHQL_MAX_COMPLEXITY).
  • createIntrospectionControlRule: disables schema introspection (__schema, __type) in production environments while keeping standard __typename queries fully functional.
• Mounted validation rules onto /graphql handler in src/index.ts and exported helpers from src/graphql/schema.ts.

Verified

• Added unit and integration tests in src/__tests__/graphql-depth-complexity.test.ts (114 passing) covering depth boundaries, alias caps, complexity limits, and introspection controls.
• All 123 test suites (1,533 tests) pass (npm test).
• Typecheck (npx tsc --noEmit) and linter pass with 0 errors.
• Production build (npm run build) succeeded.

Closes #922

Payout coordinate:
USDC (EVM / Base / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73