Closes SF-07 from the 2026-05-17 studio backend audit. New
_resolve_graph_for_request(request) async helper in
graqle/studio/routes/api.py; 12 existing route handlers
consult the helper instead of state.get("graph") directly.
When x-project-name header is present and well-formed,
returns project-specific S3-loaded graph (cached via existing
_load_project_graph); otherwise falls back to default Lambda
graph. Behaviour byte-identical to v0.57.3 when header absent.

Security: anchored regex \A[A-Za-z0-9._\- ]{1,128}\Z on the
x-project-name header (the \A\Z anchors, not ^$, defeat the
name\n bypass — caught by new tests before shipping).

Plus 22 new tests covering the helper + regex.

PRs: #148 (SF-07 fix), #149 (release metadata).
Private: #126, #127.

Sentinel chain: pass 1 CHANGES_REQUESTED 92% -> 3 fixes ->
pass 2 APPROVED 95% -> pass 3 security APPROVED 95% -> cr-022b
metadata APPROVED 4/2.