GraphQL endpoint

GraphQL endpoint (shared auth/rate limit with REST), proxied to the Ponder GraphQL API. Ponder LIKE filter operators reject unescaped % and _ wildcard values. Before proxying, the API bounds the complete request including unused runtime variables, variable defaults, inline arguments, input bytes/nodes/depth, boolean clauses, list entries, aliases, totalCount, execution cost, limit (default maximum 1,000), and offset (default maximum 10,000). Offset scan cost is offset + limit; selected output expansion remains based on limit. Resource violations return QUERY_TOO_BROAD and malformed documents return VALIDATION_ERROR without contacting Ponder. Ponder 0.15.17 does not use first or last pagination arguments. Each API process also enforces a shared upstream concurrency cap (default 8), one total fetch-and-stream timeout (default 10 seconds), redirect rejection, GraphQL JSON media-type and object-shape validation, and a streamed decoded response cap (default 5,242,880 bytes). A non-queueing per-process query-cost bucket defaults to 100,000 units of capacity and a 25,000-unit-per-second refill. Exhaustion returns 429 before an upstream slot is acquired; the shared per-client API rate limiter remains the outer control.