add graphify, update readme, claude md and gitignore

CLAUDE.md

@@ -178,6 +178,9 @@ workers. Python >=3.13,<4.0, Poetry for dependency management.
   see the `src/logging/logger.py` vs `http_logger.py` split above for why
   that boundary is enforced deliberately.
 - `dev` group: pytest stack, allure, httpie, requests-async.
+- `claude` group: `graphifyy` (the `/graphify` Claude Code skill) — dev
+  tooling only, never referenced by any Dockerfile stage, install with
+  `poetry install --with claude` when needed locally.
 - Dockerfile has parallel builder→final stage pairs: `builder`→`prod`
   (installs `main,web`) and `worker-builder`→`worker` (installs
   `main,daemon`). Same base pattern: venv builder stage copies
@@ -193,6 +196,28 @@ workers. Python >=3.13,<4.0, Poetry for dependency management.
   override `DB_HOST` via `environment:`; the `.env` file's own default is
   for host-side runs.
 
+## Codebase knowledge graph (graphify)
+
+- `/graphify` (Claude Code skill, `graphifyy` package in the `claude`
+  Poetry group) builds a navigable knowledge graph of this repo into
+  `graphify-out/` (`graph.html`, `GRAPH_REPORT.md`, `graph.json`) —
+  gitignored, regenerable, never commit it.
+- Its own interpreter/venv detection defaults to `uv tool`/pipx-style
+  installs; **this project has neither** — `graphifyy` is installed
+  straight into the project's own `.venv` via Poetry, so point graphify
+  at `.venv/bin/python3` directly rather than letting it search for `uv`.
+- The sandbox's blanket `**/.env`/`**/.env.*` read-deny blocks graphify
+  from reading `configs/.env.example` too (not just the real `.env`) —
+  it shows up as `skipped_sensitive` in detection. This is a sandbox-level
+  block, not graphify's own sensitive-file heuristic; a real `.env` would
+  be excluded by graphify anyway, but `.env.example` (no real secrets)
+  would otherwise be safe to include if the sandbox allowed reading it.
+- A `GRAPH HEALTH WARNING` (dangling-endpoint edges, collapsed edges) on
+  a fresh build most likely means the AST extractor's node-ID format
+  changed since a previous partial run — re-run with `graphify extract
+  --force` if it persists across rebuilds; a one-off warning on first
+  build isn't necessarily a problem.
+
 ## Testing (`tests/unit`, `tests/integrated`, `tests/e2e`)
 
 - **Recurring root cause of "different event loop" / `MissingGreenlet`-style