fix(api): enable gzip middleware to keep graph payload parseable

[nicoloboschi]

Summary

Add starlette's GZipMiddleware to the FastAPI app. Three-line change to the create_app factory.

Why this and not the clamp from #1605

I closed #1605 (cap limit server-side at 200) because it silently broke the Control Plane's "Load more" button on dense banks and assumed the bytes came from node count. They don't — they come from edges.

I ingested 19 LoCoMo sessions into a bank, profiled the /banks/{bank_id}/graph response at limit=500, and got:

nodes=491 edges=75718 table_rows=491

=== section sizes ===
  nodes:       194.8 KiB  (  0.9%)  avg=406 B/node
  edges:       21.2 MiB  ( 97.8%)  avg=293 B/edge
  table_rows:  282.4 KiB  (  1.3%)  avg=588 B/row

=== wire size ===
  raw (Accept-Encoding: identity): 21.7 MiB
  gzip-requested (wire):           1.6 MiB
  compression ratio:               13.8x

Edges are 98% of the payload and gzip-compresses ~14× because the list is extremely repetitive: same JSON keys per edge, UUIDs sharing session prefixes, identical linkType / color / lineStyle strings. Node text, context, and table_rows combined are <3% of bytes — trimming them would be invisible.

1.6 MiB on the wire is comfortably under V8's ~512 MiB string-length cap that was breaking the Control Plane graph view in production. No UI change required; the Control Plane's data-view.tsx useState(1000) continues to work and "Load more" still does something.

What this isn't

A real fix. The endpoint returns 75k edges from only 11.5k DB rows — the bulk are observation-inferred links built in-memory and uncapped (memory_engine.py:4880-4913). Capping that at 10k like the direct links would cut edges ~85% and is the next PR. Tracking separately so this lands fast.

Test plan

• ruff check, ruff format, ty check clean.
• Existing tests pass locally on the touched module (no behavioral changes besides response encoding).
• Verified on a 491-node / 75k-edge bank: response Content-Encoding: gzip when client sends Accept-Encoding: gzip, decompresses to identical bytes as the identity variant.
• Reviewer: sanity-check that no internal callers send Accept-Encoding: identity and then try to parse Content-Length for sizing (none I can find).

Notes

• minimum_size=1024 skips compression on small responses where the per-response gzip overhead would dominate.
• One unrelated doc-skill regen got picked up by the pre-commit hook (upstream alibaba reranker docs were never synced to skills/). Three lines, same commit.