feat: add GraphQL schema explorer command

[rianjs]

Summary

Add interactive GraphQL schema exploration using introspection queries.

API Layer (api/graphql.go)

• IntrospectSchema() - fetch full schema via introspection
• IntrospectionSchema, IntrospectionType, IntrospectionField, IntrospectionArg types
• IntrospectionTypeRef.TypeName() - resolve type references (handles NON_NULL, LIST wrappers)
• IntrospectionSchema.GetType(name) - find type by name
• IntrospectionSchema.GetRootTypes() - filter to queryable types (excludes internal __ types)

CLI Commands

• hspt graphql explore - list all available types
• hspt graphql explore --type CRM - show fields of a specific type
• hspt graphql explore --type CRM --field contact_collection - show field details with arguments

Tests

• Comprehensive API tests for introspection in api/graphql_test.go
• Tests for IntrospectSchema, GetType, GetRootTypes, TypeName

Usage Examples

# List all types
hspt graphql explore

# Explore the CRM type
hspt graphql explore --type CRM

# Explore a specific field with its arguments
hspt graphql explore --type CRM --field contact_collection

Test Plan

• make build passes
• make test passes
• make lint passes
• API tests cover introspection functionality

Closes #27

[rianjs]

Test Coverage Assessment for TDD

I reviewed the test coverage for this PR. Here's my analysis:

Current State

API Layer (api/graphql.go): ~83% coverage

• ExecuteGraphQL: 85.7%
• IntrospectSchema: 80.0%
• TypeName: 77.8%
• HasErrors, ErrorMessages, GetType, GetRootTypes: 100%
• GraphQLError.Error(): 0% (trivial one-liner, not worth testing)

Command Layer (internal/cmd/graphql/graphql.go): 0% coverage

Assessment: Is This Adequate for TDD?

The API layer coverage is solid for TDD purposes. The tests cover:

• Happy path query execution with/without variables
• GraphQL error responses (single and multiple errors)
• Empty query validation
• Auth failure handling
• Schema introspection success and failure
• Type lookup and filtering
• TypeRef unwrapping (NON_NULL, LIST, nested combinations)

The missing command-layer tests are acceptable given the codebase conventions:

1. All 30+ command packages in internal/cmd/ have 0% test coverage - this is a deliberate architectural choice, not an oversight
2. The command layer is intentionally thin - it orchestrates API calls and formats output
3. The business logic lives in api/ where it's thoroughly tested
4. Command-layer testing would mostly duplicate API tests or test Cobra flag parsing

Verdict: Coverage is Sufficient

For TDD in this codebase, the pattern is:

• API layer: test the logic (covered)
• Command layer: integration point, tested via manual/E2E if needed

The 70.7% overall API package coverage and the specific function coverage above demonstrate sufficient test rigor for the new GraphQL functionality. The untested GraphQLError.Error() method is a trivial one-liner that returns a string field.

No blocking concerns from a TDD perspective.