TypeScript: implement tRPC and GraphQL resolver entrypoint support

[bjcorder]

Parent

Part of #89.

Context

tRPC and GraphQL APIs expose externally reachable operations that may not look like HTTP route handlers. Rulepath should model procedures/resolvers as route-like entrypoints with request-controlled inputs, context evidence, and resolver-to-service/data-layer paths.

References:

• tRPC documentation: https://trpc.io/docs
• Apollo Server resolvers: https://www.apollographql.com/docs/apollo-server/data/resolvers
• GraphQL Yoga documentation: https://the-guild.dev/graphql/yoga-server/docs
• Mercurius documentation: https://mercurius.dev/

Scope

• Discover tRPC routers, procedures, query, mutation, subscription, middleware, context, input validators, and nested routers.
• Extract request-controlled sources from tRPC input schemas, procedure input, context, headers/cookies/session helpers, and middleware outputs.
• Discover GraphQL resolver maps, schema-first and code-first resolver functions, mutations/queries/subscriptions, context functions, plugins, and framework adapters where statically visible.
• Extract GraphQL args/input as request-controlled sources and context/current-user data as evidence.
• Normalize middleware/context auth, authorization, tenant/object scope, validators, and configured helpers.
• Model procedure/resolver identity in route-like IDs and stable fingerprints.
• Integrate with service tracing and data-layer sinks.

Acceptance Criteria

• tRPC unsafe fixtures emit expected findings for unsafe mutation inputs reaching sinks.
• GraphQL unsafe fixtures emit expected findings for resolver args/input reaching unscoped or unauthorized sinks.
• Safe fixtures recognize procedure/resolver middleware, context auth evidence, tenant/object scope, and safe mapping.
• Findings clearly identify the procedure/resolver and call path.

Test Plan

• Add unit tests for tRPC routers/procedures/middleware/input parsing and GraphQL resolver maps/context functions.
• Add CLI fixtures for tRPC and Apollo/Yoga/Mercurius safe and unsafe cases.
• Assert text, JSON, and SARIF entrypoint/source/evidence output.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.