GraphiQL and introspection are served unconditionally #362

Background

await app.register(mercurius, {
  schema,
  resolvers,
  graphiql: true,
  path: '/graphql',
  ...
})

graphiql: true is not conditional on the environment, so production serves a
full interactive query console at /graphiql, with schema introspection, to
anyone with the URL. Combined with L188 — GraphQL not being behind the paywall —
that is a browsable, executable console in front of the data the REST API
charges for.

Introspection on a public read API is a defensible choice. Shipping the IDE
unconditionally is almost certainly not a choice anyone made.

What to build

• Enable graphiql only outside production, or behind the same auth as the
  admin routes.
• Decide introspection separately and deliberately — a public API arguably wants
  it, a paid one arguably does not. Whichever you pick, write down why.
• If introspection stays on, make sure L190's depth limit does not break it.

Acceptance criteria

• GraphiQL is not served in production by default
• The setting is configurable and documented in .env.example
• The introspection decision is explicit and commented
• A test asserts the IDE is absent under production configuration
• POST /graphql itself is unaffected

Drips Wave · Complexity: Easy · 100 points

Repo: Divinity-Labs/Lens. Node + TypeScript, Fastify, mercurius for
GraphQL at POST /graphql, Prisma on Postgres, Redis, Prometheus.

Run the tests: npm test. The tests are vitest, not jest. Running jest
here reports "66 suites, 0 tests" and means nothing. A single file is
npx vitest run src/__tests__/graphqlSubscription.test.ts.

Load test (prices) is already failing on main and has been for some
time. It is not your PR. Everything else should be green.

Read src/__tests__/graphqlSubscription.test.ts before you start. It is the
house pattern for testing this surface and it is good — it drives a real
subscription through a real server and asserts on what a client receives.

This service prices real assets on Stellar mainnet. A wrong number is worse
than a missing one, because the caller cannot tell.

Never elide an address, a contract id or a key in code, comments or test
fixtures. A previous batch shortened a contract id in an issue and five
contributors invented plausible-looking ids to fill the gap. Write it in full or
not at all.

Required: Before submitting, join the contributor Telegram so your work can be tracked and counted toward the Stellar Wave: https://t.me/+fxHXq8f1SwlkZDBk