Summary

Adds GraphQL support as a language-group contribution under tracking issue #470 / sub-issue #488.

.graphql and .gql files were skipped by both review paths because they were missing from the extension allowlist. This PR:

1. Allows .graphql / .gql (case-insensitive) via supported_file_types.json
2. Maps **/*.{graphql,gql} → a dedicated graphql.md rule doc (schema-first and query/client focus)
3. Adds table-driven unit tests for allowlist + rule resolution

No Go production logic changes. No exclude patterns (GraphQL has no standard test-file convention per #470 / issue discussion).

Why

diff / scan path
  → user include/exclude
  → allowedext.IsAllowedExt(ext)   ← .graphql/.gql returned false → ExcludeExtension
  → SystemRule.Resolve             ← unmapped → default.md

After this PR:

api/schema.graphql / queries/user.gql
  → IsAllowedExt = true
  → Resolve(**/*.{graphql,gql}) → rule_docs/graphql.md  (Breaking Changes + ops sections)

Changes

Rule doc focus

• Schema evolution / breaking changes (nullability, required args, deprecation reasons)
• Naming conventions (graphql-eslint aligned)
• Schema-first SDL pitfalls (pagination/limit on lists, unreachable types)
• Query/client operations (deprecated fields, fragment cycles, depth in operation text)
• Security only when observable in the reviewed schema/operation file

Test plan

• RED unit tests first, then GREEN config
• go test ./internal/config/allowlist/ ./internal/config/rules/
• make test
• make check
• grep -l "Breaking Changes" rule_docs/* → only graphql.md

Out of scope

• Other feat(allowlist): expand supported file types — language experts wanted #470 language groups
• Exclude-pattern additions
• README / docs site review-rules i18n (optional follow-up)
• Path-gate e2e rows in preview_test.go / scan/coverage_test.go (unit gates cover allowlist+resolve; can add in follow-up if maintainers want)

Closes #488
Part of #470