mr-668: POST /graphs runtime create endpoint (PR 7/10)

PR 7 of the MR-668 multi-graph server work. Operators can now add a
graph to a running multi-graph server without restarting:

  curl -X POST http://server/graphs \
    -H "Content-Type: application/json" \
    -d '{
          "graph_id": "beta",
          "uri": "/data/beta.omni",
          "schema": { "source": "node Person { name: String @key }\n" },
          "policy": { "file": "./policies/beta.yaml" }
        }'

DELETE remains deferred (out of v0.7.0 scope per the trimmed plan —
no `delete_prefix`, no tombstones).

Body shape (decision 7):
  - Nested `schema: { source: "..." }` (mirrors the `policy: { file }`
    pattern; leaves room for future fields without breakage).
  - Optional nested `policy: { file: "..." }` for per-graph Cedar.
  - 32 MiB body limit (reuses `INGEST_REQUEST_BODY_LIMIT_BYTES`).
  - Asymmetric with `SchemaApplyRequest` which keeps flat
    `schema_source: String` — documented in api.rs.

Atomic YAML rewrite + drift detection:
  - New `config::rewrite_atomic(path, new_config, expected_hash)`:
    flock → re-read + hash check → serialize → write `.tmp` → fsync
    → rename → fsync parent dir. Returns the new hash for the caller
    to update its in-memory baseline.
  - New `config::hash_config_file(path)` — SHA-256 of the on-disk
    bytes, used at startup and after each rewrite.
  - New `RewriteAtomicError { Drift | Io | Serialize }` enum.
  - `AppState.config_hash: Option<Arc<Mutex<[u8;32]>>>` carries the
    in-memory baseline. Updated after every successful rewrite so
    subsequent POSTs don't false-trigger drift.
  - The mutex is `std::sync::Mutex` (brief critical section, no .await
    inside). The flock itself serializes file access process-wide
    AND across multiple server instances (defense in depth).
  - All sync I/O runs inside `tokio::task::spawn_blocking` — flock
    is sync.

Handler ordering (the load-bearing sequence):
  1. Mode check: 405 in single mode.
  2. Cedar authorize: `GraphCreate` against `Omnigraph::Server::"root"`.
  3. Validate body: `GraphId::try_from` (regex + reserved-name), empty
     schema/uri checks, per-graph policy file parse.
  4. Pre-check registry for duplicate graph_id / duplicate uri (409).
  5. `Omnigraph::init` the new engine.
  6. Atomic YAML rewrite (drift detection inside).
  7. Publish in registry (atomic re-check via `GraphRegistry::insert`).

Failure modes (documented in handler rustdoc):
  - Init fails → orphan storage at `req.uri` (PR 2a cleans up schema
    files; Lance datasets remain orphans until `delete_prefix` lands).
  - YAML rewrite fails (drift, IO) → orphan storage; YAML unchanged.
  - Registry insert fails (race) → YAML has entry but registry doesn't;
    next restart opens it cleanly.

New dependency: `fs2 = "0.4"` (workspace + omnigraph-server). POSIX-only
file locking. Linux/macOS deployment supported; Windows out of scope.

Tests (10 new in `tests/server.rs::multi_graph_startup`):
  - `post_graphs_creates_a_new_graph_end_to_end` — happy path, includes
    YAML inspection to confirm the rewrite landed.
  - `post_graphs_baseline_hash_updates_between_rewrites` — two POSTs in
    a row both succeed (drift baseline updates correctly).
  - `post_graphs_duplicate_graph_id_returns_409`
  - `post_graphs_duplicate_uri_returns_409`
  - `post_graphs_invalid_graph_id_returns_400` (reserved name)
  - `post_graphs_empty_schema_source_returns_400`
  - `post_graphs_returns_405_in_single_mode`
  - `post_graphs_yaml_drift_detection_returns_503` — operator hand-edits
    omnigraph.yaml; server refuses to clobber.
  - `hash_config_file_is_deterministic_and_detects_changes`
  - `rewrite_atomic_refuses_when_hash_drifts`

OpenAPI: `server_graphs_create` registered in `ApiDoc::paths(...)`;
openapi.json regenerated.

Result: 225 server tests green (74 lib + 66 openapi + 85 integration),
all MR-731 regressions still pinned.

LOC: ~580 lib.rs net (handler + helpers), ~120 config.rs (rewrite
machinery), +71 api.rs (request/response shapes), +332 tests/server.rs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/omnigraph-server/src/api.rs

@@ -487,3 +487,74 @@ pub struct GraphInfo {
 pub struct GraphListResponse {
     pub graphs: Vec<GraphInfo>,
 }
+
+// ─── MR-668 PR 7 — POST /graphs request/response ───────────────────────────
+
+/// Schema specification for a new graph in `POST /graphs`. Nested
+/// per MR-668 decision 7 — leaves room for future fields without
+/// breaking the request shape. Mirrors the `policy: { file }` nesting
+/// pattern.
+///
+/// Today only `source` (inline `.pg` text) is supported. Future fields
+/// might include `schema.allow_data_loss`, `schema.version`, etc.
+///
+/// **Asymmetric with `SchemaApplyRequest`**: `POST /schema/apply` still
+/// uses a flat `schema_source: String` for backwards compatibility.
+/// A follow-up release may migrate that too.
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct GraphSchemaSpec {
+    /// Inline `.pg` schema source.
+    #[schema(example = "node Person {\n    name: String @key\n    age: I32?\n}")]
+    pub source: String,
+}
+
+/// Per-graph policy specification in `POST /graphs`. Mirrors the
+/// `policy: { file }` shape in `omnigraph.yaml`'s `graphs.<id>.policy`
+/// section.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, ToSchema)]
+pub struct GraphPolicySpec {
+    /// Path to the per-graph Cedar policy file, server-side.
+    /// Must be readable by the server process at request time.
+    /// Path is relative to the server's working directory (NOT to the
+    /// `omnigraph.yaml`'s `base_dir`) — caller-supplied paths are
+    /// trusted as-is.
+    pub file: Option<String>,
+}
+
+/// Request body for `POST /graphs` (MR-668 PR 7).
+///
+/// Body shape:
+/// ```json
+/// {
+///   "graph_id": "alpha",
+///   "uri": "/path/to/alpha.omni",
+///   "schema": { "source": "<inline .pg source>" },
+///   "policy": { "file": "./policies/alpha.yaml" }
+/// }
+/// ```
+///
+/// 32 MiB body limit (matches `INGEST_REQUEST_BODY_LIMIT_BYTES`).
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct GraphCreateRequest {
+    /// New graph's id. Must satisfy `^[a-zA-Z0-9-]{1,64}$`, not start with
+    /// `_`, and not be a reserved name. See `GraphId::try_from`.
+    pub graph_id: String,
+    /// Storage URI (local path or `s3://...`). Must NOT already be in
+    /// use by another registered graph. Server `Omnigraph::init`s the
+    /// graph at this URI.
+    pub uri: String,
+    /// Inline schema (`{ source }`). Required.
+    pub schema: GraphSchemaSpec,
+    /// Per-graph Cedar policy. Optional — `None` means the graph has
+    /// no per-graph policy enforcement (HTTP auth still applies if
+    /// configured).
+    #[serde(default)]
+    pub policy: Option<GraphPolicySpec>,
+}
+
+/// Response from `POST /graphs` on success (201 Created).
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct GraphCreateResponse {
+    pub graph_id: String,
+    pub uri: String,
+}