trace_flow / analyze_impact: add JSON output (real FQNs) for agent/CI use

[zaebee]

Summary

cgis_trace_flow and cgis_analyze_impact return Mermaid only. For agent/automation use, a machine-readable (JSON) output of the same nodes+edges is needed.

Motivation (real use case)

During a security audit I needed: "which route handlers never transitively reach verify_resource_ownership?" (an IDOR sweep). With cgis_analyze_impact I got the caller set — but as a Mermaid diagram with hashed node ids (n_632b51c4...), so I had to eyeball it to confirm get_reservation_prices was missing from the ownership-callers. With a JSON edge list I could have computed set(route_handlers) - set(ownership_callers) directly and found all such endpoints across every domain in one shot.

Proposal

Add a format: "mermaid" | "json" parameter (default mermaid for back-compat) to cgis_trace_flow, cgis_analyze_impact, and cgis_get_structure. JSON shape, e.g.:

{
  "root": "app.api.dependencies.ownership.verify_resource_ownership",
  "nodes": [{"fqn": "...", "type": "FUNCTION", "file": "...", "line": 25}],
  "edges": [{"src": "...", "dst": "...", "type": "CALLS"}]
}

Real FQNs (not display hashes) so results are joinable across calls.

Impact

Turns these tools from "human diagrams" into composable primitives for LLM agents and CI scripts — the building block for audits like authz-coverage, dead-code, layering checks.