Add Rate Limiting and Query Depth Protection to GraphQL Endpoint

**Is your feature request related to a problem? Please describe.**

The REST API (`/api/v0/`) has rate limiting provided by AuthRateThrottle(`"10/s"`) (Issue #1618), but not for GraphQL API (`/graphql/`).

This creates a security gap where:
1. **DoS Attack**: Attackers can flood the `/graphql/` endpoint with unlimited requests, potentially overwhelming the server
2. **Resource Exhaustion**: Deeply nested GraphQL queries can cause exponential database load through N+1 query patterns
3. **Batch Query Abuse**: Multiple expensive operations can be executed in a single HTTP request

Current state comparison:

| API | Endpoint | Rate Limiting | Query Depth Limit |
|-----|----------|---------------|-------------------|
| REST API | `/api/v0/*` | ✅ 10/s per user | N/A |
| GraphQL API | `/graphql/` | ❌ None | ❌ None |

---

**Describe the solution you'd like**

1. **Add request rate limiting** to the GraphQL endpoint (similar to REST API's 10 requests/second limit)

2. **Add Strawberry's built-in `QueryDepthLimiter` extension** to prevent deeply nested query attacks:

```python
from strawberry.extensions import QueryDepthLimiter

schema = strawberry.Schema(
mutation=Mutation,
query=Query,
extensions=[
CacheExtension,
QueryDepthLimiter(max_depth=10), # NEW: Limit query nesting depth
]
)
```

3. **Consider query complexity analysis** for additional protection against expensive queries

---

**Describe alternatives you've considered**

1. **Nginx-level rate limiting**: External to the application, less granular control, can't differentiate by user/session
2. **Django middleware for rate limiting**: Requires custom implementation; could use `django-ratelimit` package
3. **Query complexity/cost analysis**: More sophisticated - assigns "cost" to each field and rejects queries exceeding a threshold
---

**Are you going to work on implementing this?**

- [x] Yes
- [ ] No

---

**Additional context**

**Related Issues/PRs:**
- Issue #1618: "Implement API rate limiting" (CLOSED) - Implemented for REST API only
- Current REST API throttle implementation: `backend/apps/api/rest/v0/__init__.py:45`
- Current GraphQL schema: `backend/settings/graphql.py:44` (no rate limiting extensions)

**Example malicious query that could cause resource exhaustion:**

```graphql
query DeepNestedQuery {
projects {
issues {
author {
repositories {
issues {
author {
repositories {
issues {
title
}
}
}
}
}
}
}
}
}
```

**References:**
- Strawberry QueryDepthLimiter docs: https://strawberry.rocks/docs/extensions/query-depth-limiter
- OWASP GraphQL Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html