[WIP] Enforce platform database access at the GraphQL boundary

[yyyyaaa]

WIP status

This is a draft. The GraphQL boundary implementation is locally validated, but it remains coupled to the platform billing Sandbox qualification and is not merge-ready until the cross-repository lifecycle and access matrix pass.

Scope

• Evaluate database access before tenant hydration and request-body parsing.
• Use the configured platform access-policy function with bounded pooling and deadlines.
• Return stable HTTP and GraphQL errors for suspended access and policy unavailability.
• Bind internal identity to the trusted server surface.
• Preserve structured execution error codes and retryability.

Architecture boundary

GraphQL remains transport, authentication, routing, schema exposure, and policy enforcement only. Checkout, subscriptions, reconciliation, webhooks, entitlements, and other billing workflow stay in CNC functions in constructive-db.

Validation completed locally

• 56 focused GraphQL policy and transport tests passed.
• Affected package builds passed.
• The local composed stack serves the public and private GraphQL surfaces with the policy boundary enabled.

Remaining before review

• Re-run the affected and full integration gates after the backend branch is rebased.
• Prove paid GraphQL access and suspended-policy rejection through the Dashboard.
• Prove policy-unavailable behavior under composed local conditions.
• Link final sanitized Sandbox and database-access evidence.

Boundaries

This PR intentionally contains no Stripe provider workflow, subscription state machine, or tenant billing behavior.

[yyyyaaa]

Closing as superseded by the generic database-standing path now on main via #1815. Current main reads the system-controlled suspended_at / suspended_reason state through the shared standing loader, fails closed on lookup errors, and refuses GraphQL requests before request protection/admission and GraphQL execution. The platform-billing launch candidate now uses that shared contract, so retaining this older configurable billing-policy middleware would duplicate authority, pooling, identity, and error behavior in Core.

Focused verification on current main: standing middleware 6/6, standing loader 7/7, error registry/HTTP 9/9, and the GraphQL server dependency build passed. The existing PR branch is preserved; no replacement code was force-pushed.