Accept modern rootless Terraform DOT input

[Ianyliu]

Summary

• add POST /api/graphs/render for JSON DOT rendering with SVG, graph data, and warnings
• accept valid modern Terraform graphs without the obsolete [root] root node
• preserve /input and /upload response compatibility
• return structured 400, 413, and 422 errors for bad input
• display paste/upload failures inline and remove the reload confirmation flow

Root Cause

The frontend treated [root] root as a required node and dereferenced it even after labeling the graph invalid. Current Terraform versions can emit valid dependency graphs without that historical synthetic node, so pasted output was incorrectly rejected and could trigger a JavaScript error.

User Impact

Users can paste or upload current terraform graph output directly. Invalid, malformed, or oversized input now produces an actionable message within the graph tab instead of a reload prompt.

Validation

• /tmp/blast-radius-plan-venv/bin/python -m pytest -q — 17 passed, 7 subtests passed
• actual local Graphviz render through /api/graphs/render — HTTP 200, two nodes
• node --check blastradius/server/static/js/blast-radius.js
• Ruff passes for the new regression tests
• git diff --check main...HEAD
• coverage includes rootless DOT, legacy input/upload routes, invalid JSON/options/DOT, 2 MiB limit behavior, missing refocus warnings, and inline frontend errors

Compatibility

/input, /upload, /graph.svg, and /graph.json remain available. Legacy form routes retain their SVG/JSON response keys; the new API uses lowercase typed fields and an object-shaped graph value.

Fixes #45

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.