feat: add missing SAFE_ERROR_CODES for rate limiting and auth errors

Add error codes that are raised by constructive-db deployed functions but
were missing from the production error masking allowlist:

- IP_RATE_LIMITED (new — from rate_limits_module IP throttling)
- PASSWORD_RESET_LOCKED_EXCEED_ATTEMPTS (password reset lockout)
- CSRF_TOKEN_REQUIRED, INVALID_CSRF_TOKEN (CSRF validation)
- TOTP_NOT_ENABLED (TOTP verification)
- NULL_VALUES_DISALLOWED (reset_password validation)
- OBJECT_NOT_FOUND (invite/object lookups)
- LIMIT_REACHED (membership/invite limits)
- REQUIRES_ONE_OWNER (ownership constraints)

Without these, production clients would receive masked 'INTERNAL_SERVER_ERROR'
instead of the actionable error codes.

Author: pyramation

graphql/server/src/middleware/graphile.ts

@@ -36,6 +36,19 @@ const SAFE_ERROR_CODES = new Set([
   'INVITE_LIMIT',
   'INVITE_EMAIL_NOT_FOUND',
   'INVALID_CREDENTIALS',
+  // CSRF
+  'CSRF_TOKEN_REQUIRED',
+  'INVALID_CSRF_TOKEN',
+  // Rate limiting / throttling
+  'IP_RATE_LIMITED',
+  'PASSWORD_RESET_LOCKED_EXCEED_ATTEMPTS',
+  // TOTP
+  'TOTP_NOT_ENABLED',
+  // Account / resource operations
+  'NULL_VALUES_DISALLOWED',
+  'OBJECT_NOT_FOUND',
+  'LIMIT_REACHED',
+  'REQUIRES_ONE_OWNER',
   // PublicKeySignature
   'FEATURE_DISABLED',
   'INVALID_PUBLIC_KEY',