feat(graphql-server): record refusals as their error code via events record_error

[pyramation]

Summary

A refused authenticated mutation is now recorded under the error code errors.raise_error raised as the event name, instead of a generic transport-shaped graphql.error {code, operation} event. The server carries no ladder policy: it forwards the code and the operation, and the tenant's generated record_error registers the event_types row (category = 'error', feeds_levels = false) so a trust ladder's revoked_by names the code directly, e.g. PRINCIPAL_CHILD_WIDENS.

-const GRAPHQL_ERROR_EVENT = 'graphql.error';
-recordEventSql(events)  // record_event($1 name, $2 actor, $3 payload {code, operation})
+recordErrorSql(events)  // SELECT <private>.<record_error>($1, $2::uuid, $3::jsonb)
+// args: [code, actorId, JSON.stringify({ operation })]

EventsConfig gains recordError: string | null (loaded from the new events_module.record_error column, keeping recordEvent for other callers). A tenant whose events module predates the column still loads — recordErrorSql throws and the plugin logs failed to record refusal <code> for <actor>, rather than silently skipping the refusal.

Fixture pin bumped to @pgpm/metaschema-modules@0.44.1, which carries the events_module.record_error column (constructive-io/pgpm-modules#126, upstreamed from constructive-io/constructive-db#3683). Both error-events integration suites and the plugin unit tests pass locally.

Design: constructive-io/constructive-planning#1986

Link to Devin session: https://app.devin.ai/sessions/835118130e99423c9344bb04415a7398
Open in Devin Desktop: https://app.devin.ai/desktop/session/835118130e99423c9344bb04415a7398?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This PR introduces error-event recording for the GraphQL server. It adds recordErrorSql in packages/express-context/src/loaders/events.ts and a new error-events-plugin.ts that records a graphql.error event whenever an authenticated mutation is refused, resolving the actor from principal/user and running on a fresh transaction after a rolled-back mutation. It also ships app_events/event_types schema and seed fixtures under graphql/server-test/__fixtures__/seed/error-events/ plus integration and unit tests, and bumps the metaschema-modules dependency to 0.44.1 (which provides the record_error column) in pgpm.json.

Files	Change
graphql/server/src/plugins/error-events-plugin.ts + tests	New plugin middleware recording refusal events; recordErrorSql throws when record_error is null (caught and logged, client response unchanged)
packages/express-context/src/loaders/events.ts + types.ts	Adds recordErrorSql helper and required recordError on EventsConfig
graphql/server-test/__fixtures__/seed/error-events/*	New app_events/event_types schema and events-module seed fixtures
graphql/server-test/__tests__/*	Integration tests (with and without module) plus shared helpers
pgpm.json	Bumps metaschema-modules to 0.44.1 for the record_error column

No findings met the confidence threshold; the only adjudicated candidate (confidence 75) concerns generated CLI code outside this PR's diff and is excluded.

_{Reviewed commit: 07f6a74}