Issue #1309: fix: keep the Query Planner's error body out of GraphQL mutation errors

[dereck-symmetry]

Description of Change

Problem. The GraphQL update mutation raised Exception(f"Mutation failed: {response.status_code}: {response.text}") (components/lif/openapi_to_graphql/type_factory.py:991). Strawberry puts that message into the errors entry the caller receives. The Query Planner's /update handler builds its 500 body from str(e) of any exception it catches (bases/lif/query_planner_restapi/core.py:287-288). So whatever a backend exception said (a driver message, a host, a username) reached whoever held a GraphQL API key.

This is the leak bjagg measured on the query path in #1291, where a credential-shaped 500 reached the caller as Query failed: 500: {"detail":"FATAL: password authentication failed for user \"lifadmin\" host=10.0.3.17"}. His approval left the mutation's copy as a follow-up, filed as #1309.

Solution. The same one-line change #1291 made to the query path: drop : {response.text} from the raised message. The logger.error line keeps the full body for operators, and a comment points back at the query path. The caller still gets the status (Mutation failed: 500), so a failed mutation stays clearly a failure.

Side effects. Only the error text changes. The MCP lif_mutation tool passes on the GraphQL error, so its tool error gets shorter. The body is no longer available to the caller for debugging; it's in the GraphQL server log instead.

How reviewers should test it.

uv run pytest test/components/lif/openapi_to_graphql/test_core.py -q -k MutationFailure

To confirm the test guards the change: put : {response.text} back into the raise and the test fails on assert "mongodb-org1" not in result.errors[0].message.

Related Issues

Closes #1309
Refs #1131

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Project Area(s) Affected

• components/
• test/ or e2e/
• Documentation (docs/, READMEs, ARCHITECTURE.md, CLAUDE.md)

---

Checklist

• commit message follows commit guidelines (see commitlint.config.mjs)
• tests are included (unit and/or integration tests)
• code passes linting checks (uv run ruff check)
• code passes formatting checks (uv run ruff format)
• code passes type checking (uv run ty check)
• pre-commit hooks have been run successfully
• configuration changes: relevant folder README updated

Testing

• Automated tests added/updated

TestMutationFailureDoesNotLeakBody builds a real schema with a mutable field, stubs httpx.AsyncClient with the same fake the #1264 tests use, and runs updatePerson against a 500 whose body names mongodb-org1:27017. It asserts that the caller gets an error, that the error includes 500, and that the host name isn't in it.

• On main it fails on the host assertion (the message was Mutation failed: 500: {"detail":"connection refused: mongodb-org1:27017"}), having already passed the schema build and the 500 check. So it fails for the right reason.
• With the fix it passes, along with the rest of test/components/lif/openapi_to_graphql/.
• pre-commit run --files on all four changed files is green, including the full pytest suite.

The api_graphql README's error contract now says the message carries only the status, and that the Query Planner body goes to the server log. There's also a CHANGELOG entry.

Additional Notes

Shared brick (#1171). components/lif/openapi_to_graphql is packaged by lif_graphql_api only, and the GraphQL deploy workflow already covers it (the #1291 and #1301 merges both redeployed GraphQL).

Merge order. This PR, #1310 and #1148 each add a line at the top of CHANGELOG.md's [Unreleased] → ### Changed list. Whichever merges later keeps both lines. There's no other file overlap with open PRs.

🤖 Generated with Claude Code

[dereck-symmetry]

Merge-order note: #1314 (#1293) removes the module-level type_factory.input_type_cache, and this PR's new TestMutationFailureDoesNotLeakBody resets it with monkeypatch.setattr(type_factory, "input_type_cache", {}). Measured by a trial merge: test_core.py conflicts textually (both append a class at the end, so keep both), and once resolved this test fails with AttributeError: ... has no attribute 'input_type_cache'. Whichever of the two merges second should also delete that one line; the brick then passes (31 in the trial). Details in the #1314 description.

[bjagg]

Approving: the change is correct and mirrors #1291. 30 pass; putting response.text back fails the new test, and dropping the status is caught too.

Two non-blocking notes. (1) Nothing guards "the body is still logged": removing the logger.error line passes all 30. Same gap as the query-path test, so consistent, just unguarded. (2) _FakeResponse keeps text and json() independent, so a leak via response.json() would pass these tests. It's fine against real httpx, but deriving json() from text in the fake would close it.