ALL-530 — Monitor GraphQL schema + resolvers (with service layer from ALL-529)

Plan A confirmed by Seph. Build the monitor service layer (entities, repo, service) AND the GraphQL surface (queries + mutations + federation extensions + auth + tests) in one PR. Branch: wintermute/all-530-monitor-graphql-resolvers (pushed). Key constraints from Seph (2026-05-13): - Any PR that requires bumping packages/event-bus version must be SEPARATE. ALL-530 GraphQL surface should not need an event-bus bump (the event schema for monitor.transition already shipped in #9984). If a need arises (e.g. monitor.created audit event), pull it into its own PR. - Templates (ALL-531) still backlog — stub a minimal in-process template registry so monitorTemplates returns real data and createMonitor validates against it. TODO comment + note in ALL-531 to enrich later. Acceptance criteria from ALL-530: - Subgraph SDL covers all queries/mutations/federation extensions w/ auth directives. - Every resolver does explicit authorization.workspace(...).can(Read|Write)OrThrow(). - Mutations increment Monitor.version + surface MONITOR_VERSION_CONFLICT typed error. - __resolveReference enforces ownership + returns null on unauthorized. - monitorPreview hits monitoring ES index, not Postgres. - Repo layer returns Prisma types; service layer maps to domain types; resolvers return domain types. - yarn graphql:schema:publish runs clean. - Lint + build clean in domains/device. - Unit tests for service layer + 1 integration test.