feat(recorder): log replayable query records for allowlisted developers

[elffjs]

Summary

• Adds a ReplayLogger gqlgen extension that emits one structured log line per operation from developers on a configured allowlist, containing the raw query, variables, operation name, JWT subject, and vehicle token ID — everything needed to replay the request against a test environment.
• New RECORDED_DEVELOPERS setting: comma-separated developer license addresses (comma-separated string because the shared env loader only overrides scalars). Empty/unset disables recording entirely — the extension is not registered. Invalid addresses fail at startup.
• Wired through configureGQLExtensions, so the HTTP GraphQL and MCP paths record identically.

Notes

• Logging is synchronous by design: no shared state to contend on, the write is microseconds against millisecond requests, and fire-and-forget would silently drop records on shutdown or pile up goroutines if stdout stalls.
• Address matching normalizes via common.HexToAddress, so config casing vs. JWT checksum casing doesn't matter.
• Harvest records from the log pipeline by filtering on message query replay record and the developer field.

Test plan

• go test ./internal/queryRecorder/ — covers allowlist parsing, a recorded request (field-level assertions on the JSON line), non-allowlisted developers, and unauthenticated requests.
• make lint clean.

🤖 Generated with Claude Code