feat: add unified auth GraphQL integration

[Zetazzz]

Summary

• forward the request-owned Constructive Context and server-read first-party browser binding into Graphile
• expose unified-login start, confirm, local sign-in, registration, and Provider discovery operations
• use the Tenant SSO surface and identity-provider loaders without parallel Tenant, secret, or private-table access
• extend the owned auth-cookie plugin with GraphQL AST/alias support and host-only unified-auth cookies
• define the Constructive-to-DB function contract for the matching Constructive DB stack

Stack

Base: feat/oauth-sso-context / #1685. This is PR 4 of the OAuth/SSO platform-integration stack.

The runtime operations depend on the matching Constructive DB SSO functions. Schema construction, disabled-mode behavior, request-context forwarding, and service contracts are covered independently in this PR.

Validation

• pnpm --filter @constructive-io/graphql-server exec jest --runInBand (16 suites, 156 tests)
• pnpm --filter @constructive-io/graphql-server build
• pnpm --filter graphql-server-test build
• pnpm --filter @constructive-io/csrf exec jest --runInBand --modulePathIgnorePatterns <rootDir>/dist (22 tests)
• lint for affected packages (existing warnings only)
• pnpm install --offline --frozen-lockfile
• git diff --check

Two pre-existing graphql-server-test routed fixtures were also exercised; they currently fail before the Graphile handler because their baseline catalog/route seed is absent, so they are not listed as passing validation here.