Security: GraphQL injection in fetchTypeDetails via string interpolation

## Summary

`fetchTypeDetails()` in `apps/graphql/src/tools/graphql.tools.ts` constructs a GraphQL query by interpolating the `typeName` parameter directly into the query string:

```typescript
const typeDetailsQuery = `
query TypeDetails {
__type(name: "${typeName}") {
```

A crafted type name containing `")` can break out of the string argument and inject arbitrary GraphQL syntax.

## Attack Example

```
typeName = '") { name } } # injected'
```

This produces:
```graphql
query TypeDetails {
__type(name: "") { name } } # injected") {
...
```

The attacker's payload executes as valid GraphQL, while the original query after the `#` becomes a comment.

## Impact

- Schema introspection bypass (dump types not intended for the tool)
- Potential to craft queries that extract data from fields the tool wasn't designed to expose
- While limited to Cloudflare's read-only GraphQL API, it circumvents the tool's intended scope

## Suggested Fix

Use a GraphQL variable instead of string interpolation:

```typescript
query TypeDetails($typeName: String!) {
__type(name: $typeName) {
```

The codebase already has `executeGraphQLQuery()` which supports variables — this pattern should be applied consistently.

Start in apps/graphql/src/tools/graphql.tools.ts at fetchTypeDetails() and inspect executeGraphQLQuery() for its existing variable support. Confirm typeName is passed through a GraphQL variable rather than query-string interpolation, then verify the supplied attack example no longer changes the query structure.

Written by the indexing model from the issue text.