[WIP] Enforce platform database access at the GraphQL boundary

[yyyyaaa]

WIP status

This is a draft. The GraphQL boundary implementation is locally validated, but it remains coupled to the platform billing Sandbox qualification and is not merge-ready until the cross-repository lifecycle and access matrix pass.

Scope

• Evaluate database access before tenant hydration and request-body parsing.
• Use the configured platform access-policy function with bounded pooling and deadlines.
• Return stable HTTP and GraphQL errors for suspended access and policy unavailability.
• Bind internal identity to the trusted server surface.
• Preserve structured execution error codes and retryability.

Architecture boundary

GraphQL remains transport, authentication, routing, schema exposure, and policy enforcement only. Checkout, subscriptions, reconciliation, webhooks, entitlements, and other billing workflow stay in CNC functions in constructive-db.

Validation completed locally

• 56 focused GraphQL policy and transport tests passed.
• Affected package builds passed.
• The local composed stack serves the public and private GraphQL surfaces with the policy boundary enabled.

Remaining before review

• Re-run the affected and full integration gates after the backend branch is rebased.
• Prove paid GraphQL access and suspended-policy rejection through the Dashboard.
• Prove policy-unavailable behavior under composed local conditions.
• Link final sanitized Sandbox and database-access evidence.

Boundaries

This PR intentionally contains no Stripe provider workflow, subscription state machine, or tenant billing behavior.