refactor: 각 어댑터터별 리펙토링 진행

docker-compose.infra.yml

@@ -325,6 +325,37 @@ services:
       - caskeleton-infra
     restart: "no"
 
+  # The GraphQL transport, as a request. auth-smoke proves a token can be obtained and that public
+  # health answers; this proves /graphql is guarded and that an authenticated query executes.
+  graphql-smoke:
+    profiles:
+      - local-graphql
+      - all-adapters
+    image: curlimages/curl:8.10.1
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    # uid 0 for the mounted 0600 client secret, same as auth-smoke.
+    user: "0:0"
+    entrypoint: ["/bin/sh", "/opt/graphql-smoke/graphql-smoke.sh"]
+    environment:
+      APP_BASE_URL: "http://app:8080"
+      KEYCLOAK_ISSUER: "http://keycloak:8080/realms/ca-skeleton"
+      KEYCLOAK_CLIENT_ID: "ca-skeleton-api"
+      # Spring for GraphQL serves its own endpoint through a router function rather than an
+      # annotated controller, so the presentation base-path prefix does not apply to it.
+      GRAPHQL_PATH: "${GRAPHQL_PATH:-/graphql}"
+    volumes:
+      - type: bind
+        source: ./infra/graphql/smoke
+        target: /opt/graphql-smoke
+        read_only: true
+    secrets:
+      - keycloak-graphql-smoke-client-secret
+    networks:
+      - caskeleton-infra
+    restart: "no"
+
   # ---- One-shot smoke clients --------------------------------------------------
   # Never `up --wait` targets. Each is run with `run --rm` and must exit zero; a missing, skipped or
   # non-zero one fails its lane rather than being treated as "not applicable".