Separate system operations from core objects in GraphQL endpoints

[ehconitin]

Moves system-level operations (auth, billing, admin) to use the /metadata endpoint instead of /graphql.

This cleans up the endpoint separation so /graphql is purely for core objects (Company, People, etc.) and /metadata handles all system operations.

Part of prep work for webhook/API key core migration.