Fix GraphQL remittance auth and production bootstrap

[darcszn]

Summary
This PR fixes two production regressions affecting remittance access:

GraphQL remittance resolvers were bypassing the row-level authorization that the REST route enforces for non-admin callers.
Production bootstrap did not install the default remittance store, leaving the remittance APIs and GraphQL remittance queries unavailable in deployed runtime.
Root cause
SR-154: GraphQL remittance resolvers bypassed owner checks
The REST route for /api/remittances applies a role-aware filter before querying the store:

admin callers may filter by agent
non-admin callers are restricted to auth.userId
The GraphQL resolvers did not use the request context at all. As a result, any authenticated caller could query arbitrary remittance history through GraphQL by setting agent or by requesting a specific id.

SR-155: default remittance store not wired in production
createApp() accepted an optional remittanceStore, but the real process entry point index.ts never passed one in. The app therefore returned 503 Remittance store not configured in runtime even though a default store factory existed and was designed for production use.

Changes
Enforced GraphQL row-level authorization in createResolvers() using the request GraphQLContext:
remittances now respects the same admin ? agent : userId rule as the REST endpoint
remittance(id) now returns null unless the user is admin or owns the remittance row
Wired the default remittance store into the app startup path when DATABASE_URL is set and no explicit store is injected
Added regression coverage for non-admin GraphQL access attempts to another user's remittance data
Files touched
resolvers.ts
app.ts
graphql.test.ts
Verification
This work was updated without running broad test or lint commands, per the request to skip checks during the patch cycle.

Notes
This PR intentionally keeps the changes narrowly scoped to the reported SR-154 and SR-155 regressions.

closes #1297
closes #1298

[vercel]

@darcszn is attempting to deploy a commit to the Harold's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@darcszn Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits