graphql: Missing query complexity and alias bounds on repos field

[euxaristia]

Summary

POST /graphql accepts anonymous queries without depth, alias, or complexity limits (crates/gitlawb-node/src/graphql/mod.rs:79-88). Each aliased repos root field executes two unpaginated database queries (crates/gitlawb-node/src/graphql/query.rs:12-45).

Impact

One request with many aliased root fields multiplies database queries and heap allocations.

Remediation

1. Enforce query complexity and alias limits before execution.
2. Paginate repository results.
3. Batch visibility lookups."

[beardthelion]

PR #408 implements this (document complexity cap, depth limit, per-root cost so aliases consume the budget). It predates this issue; linking here so the merge can close it.