feat(api): POST /graphs/{slug}/re-migrate superuser endpoint (Phase 7 #59)

[charlie83Gs]

Summary

Manual recovery path for stuck graphs — dispatches `graph_migration_wf`
(PR #267) with the plugin's `current_version` as the target.
Auto-dispatch at worker boot (#58) handles regular version bumps; this
endpoint exists for the "something went wrong" case:

• Previous workflow crashed / was cancelled, leaving an `in_flight`
  audit row the auto-dispatch path now skips.
• Graph sits at `status='error'` from a hop failure that's since been
  fixed in code.
• Plugin was re-registered after being rolled back.

Idempotency comes from the workflow itself — `find_hop` +
`mark_skipped` short-circuit success/skipped audit rows on replay.
This endpoint just provides the trigger.

Guards

• 404 — unknown graph slug
• 409 — plugin for `graph_type_id` not registered (fix the plugin first)
• 403 — non-superuser (enforced via `SYSTEM_MANAGE_GRAPHS`)

Tests

4 integration tests cover happy-path dispatch payload, 404, 409, and
403. Dispatch is mocked since the in-worker behaviour of the workflow
itself is already covered by `test_graph_migration_workflow.py` in
PR #267.

Test plan

• `uv run --project services/api pytest services/api/tests/integration/test_re_migrate_endpoint.py -x` — 4/4
• `uv run --project services/api pytest services/api/tests/integration/test_graph_read_only_endpoint.py services/api/tests/integration/test_re_migrate_endpoint.py -x` — 9/9
• CI green

Related

• Requires PR feat(worker-bottomup): graph_migration_wf Hatchet workflow (Phase 7 #57) #267 merged for the workflow to actually exist at
  dispatch time — but this PR only names the workflow by string, so
  the two can merge in either order.
• Paired with feat(worker-synthesis): store synthesis errors and add regeneration #58 (startup auto-dispatch) for the complete Phase 7
  trigger surface.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}