[codex] Bound graph API construction by limit

[hnabyz-bot]

What changed

• Bounds the app graph API by the requested limit before edge expansion.
• Keeps graph node filtering for q and nodeType while avoiding full-vault link expansion for small graph requests.
• Adds a focused regression test for limit-before-edge-expansion behavior.

Why

P1-scale vault smoke testing showed /api/v1/projects/:id/graph?limit=... timing out because the endpoint scanned and linked the entire vault before truncating the response. This made even limit=1 unusably slow after a large vault publish.

Validation

• P1 app API smoke passed against the rebuilt local release binary after the fix: reports/p1-app-smoke-202606280000 in the ops repo.
• On the original local app checkout, cargo check --lib, the focused graph test, and release build passed.
• On this fresh upstream-based worktree, cargo check --lib could not complete because the upstream v0.5.2 build script requires ..\mcp-server\node_modules, which is not present on this machine/worktree.