feat(poimen): restrict the GraphQL server to the memory proxy

poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the
internet. It had no NetworkPolicy, so every pod in the cluster could reach it.

The only caller is poimen-memory, which forwards its /graphql route to
MEM_GQL_PORT=8090. No other workload references the service.

Allows 8090 from poimen-memory pods only.

k8s/infra/poimen/graphql-netpol.yaml

@@ -0,0 +1,28 @@
+---
+# Keep the GraphQL server reachable only from the one service that proxies it.
+#
+# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
+# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
+# every pod in the cluster.
+#
+# The only caller is poimen-memory, whose /graphql route forwards the request body
+# to MEM_GQL_PORT (8090). No other workload references this service.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: poimen-graphql-ingress
+  namespace: poimen
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: poimen-graphql
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: poimen-memory
+      ports:
+        - protocol: TCP
+          port: 8090