Previously `introspection` was disabled at the Apollo level in production entirely. Tighten by moving the policy into the complexity plugin: introspection is allowed at the transport level, but the plugin rejects introspection-only queries from non-admin callers in production with an explicit `INTROSPECTION_FORBIDDEN` error. Anonymous schema disclosure remains blocked. Admins can now introspect the production API, useful for ad-hoc debugging and schema diffs against deployed state. Authenticated non-admin users still get the forbidden error; they can operate against the checked-in apps/api/schema.gql like everyone else. The dev-only bypass that exempted introspection from complexity scoring is preserved (still useful when codegen runs against a live local API instead of the static schema file).