Don't use contexts, just raw Apollo, since it's cached anyway.

Change "ReadonlyHidden" to "IfLoggedIn".

…ieving them from a context.Context

Included in the changes:
- create a new /api root package to hold all API code, migrate /graphql in there
- git API handlers all use the cache instead of the repo directly
- git API handlers are now tested
- git API handlers now require a "repo" mux parameter
- lots of untangling of API/handlers/middleware
- less code in commands/webui.go

… rendering

Co-authored-by: Quentin Gliech <quentingliech@gmail.com>