feat(graphql): add GraphQL plugin with full document CRUD

[lane711]

Summary

• Adds opt-in graphqlPlugin() built on graphql-yoga (Cloudflare Workers-compatible — standard Fetch API, no Node.js http)
• POST /graphql — query/mutation execution with Bearer API key auth (reuses existing apiKeyAuthMiddleware)
• GET /graphql — GraphiQL playground
• Full document ACL enforced per-operation (R1/R3/R4 compliant)
• README updated with GraphQL section and usage examples

Schema

type Query {
  documents(typeId: String, status: String, limit: Int, cursor: String): DocumentPage!
  document(id: String!): Document
}

type Mutation {
  createDocument(typeId: String!, title: String, slug: String, data: JSON!, publishOnCreate: Boolean): Document!
  updateDocument(id: String!, title: String, slug: String, data: JSON): Document!
  publishDocument(id: String!): Document!
  unpublishDocument(id: String!): Document!
  deleteDocument(id: String!): Boolean!
}

Test plan

• GET /graphql returns GraphiQL HTML
• POST introspection returns Query, Mutation, Document, DocumentPage, JSON types
• documents(status:"all") returns paginated results with keyset cursor
• Unauthenticated mutation returns auth error (not 500)
• E2E: 100-graphql.spec.ts @api — mint API key → create → publish → delete flow

Usage

import { graphqlPlugin, createSonicJSApp } from '@sonicjs-cms/core'

export default createSonicJSApp({
  plugins: { register: [graphqlPlugin()] },
})

🤖 Generated with Claude Code