Add authenticated read-only GraphQL query transport #499

Add a narrowly scoped query-only GraphQL transport to support the approved immutable container tag parity work. Reuse the account-bound Dio client, PAT/OAuth authentication and existing OAuth refresh behavior; derive /api/graphql without losing self-hosted subpaths or changing REST routing. Require explicit named query selection and variable payloads, fail closed on GraphQL errors/partial/malformed responses, retain nullable fields for feature-level unavailable handling, and sanitize all domain errors. Add endpoint/header/refresh/HTTP/transport/response tests before implementation. No UI, mutations, dependency additions, or live GitLab calls in this slice.