release v4.1.2 - #1433

The server already handles Cypher over HTTP on the ledger-scoped routes
(application/cypher on POST /query/{ledger} and POST /update/{ledger}); the
gap was entirely client-side. The CLI previously rejected Cypher on any
server-routed (Tracked) ledger with a stale 'HTTP Cypher endpoint not yet
available' message.

- remote_client: add query_cypher and update_cypher_body, which send the
  body verbatim (raw Cypher or a {cypher, params} envelope) as text; the
  server extracts the envelope itself.
- query: route the Tracked arm through query_cypher, returning cypher-json.
  Reject --format json/typed-json/csv/tsv and --at before the network call
  (the server renders cypher-json only and has no Cypher time travel),
  pointing to --direct for local rendering.
- update: route the Tracked arm through update_cypher_body; reject --policy*
  for Cypher writes on both transports (no enforcement path yet), matching
  the local arm.
- docs, help text, and integration tests for the new rejection paths.