fix(api): normalize GraphQL HTTP errors

[efegokdemir]

Fixes #293.

Summary

GraphQL Query and Mutate calls currently expose the dependency's raw string error for non-2xx responses. This prevents callers from inspecting the HTTP status, response headers, and structured error message consistently with REST and Do calls.

Changes

• Wrap the GraphQL transport to convert non-2xx responses through the existing HandleHTTPError parser.
• Unwrap the resulting transport error before returning it from Query and Mutate.
• Preserve the existing GraphQL error conversion for valid 2xx responses containing a GraphQL errors array.
• Add regression tests covering unauthorized queries and forbidden mutations.

Testing

• go test ./pkg/api ✅
• go test ./... ✅
• go test -race ./pkg/api ✅
• go vet ./... ✅
• gofmt -w pkg/api/graphql_client.go pkg/api/graphql_client_test.go ✅
• git diff --check ✅

Notes

The change reuses the existing HTTPError and HandleHTTPError behavior, so GraphQL and REST callers receive the same structured error type. The implementation was assisted by an AI coding tool and manually reviewed against the repository code and tests.