feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/apollo-router/Dockerfile

@@ -0,0 +1,29 @@
+# Apollo Router Dockerfile (v2.1 M2)
+#
+# 自包含镜像：rover（组合 supergraph）+ apollo-router（运行时）
+# 启动时自动等待子图就绪 → rover compose → 启动 router
+
+FROM ghcr.io/apollographql/router:v1.45.0
+
+USER root
+
+# 安装 curl（healthcheck + rover 下载）
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# 安装 rover（Apollo CLI for supergraph composition）
+RUN curl -sSL https://rover.apollo.dev/nix/v0.30.0 | sh -s -- --install /usr/local/bin
+
+# 接受 ELv2 许可
+ENV APOLLO_ELV2_LICENSE=accept
+
+# 复制配置文件
+COPY router.yaml /dist/configuration.yaml
+COPY supergraph.yaml /dist/supergraph.yaml
+COPY entrypoint.sh /dist/entrypoint.sh
+RUN chmod +x /dist/entrypoint.sh
+
+EXPOSE 3000 8088
+
+ENTRYPOINT ["/dist/entrypoint.sh"]

infra/apollo-router/entrypoint.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# Apollo Router 启动脚本
+#
+# 1. 等待所有子图 /graphql 端点就绪
+# 2. 使用 rover 组合 supergraph SDL
+# 3. 启动 apollo-router
+
+set -e
+
+SUBGRAPHS=(
+  "iam:3002"
+  "core-edu:3004"
+  "content:3005"
+  "msg:3007"
+  "ai:3008"
+  "data-ana:3006"
+)
+
+echo "[apollo-router] Waiting for subgraphs to be ready..."
+
+wait_for_subgraph() {
+  local name="$1"
+  local host="$2"
+  local port="$3"
+  local max_retries=60
+  local retry=0
+
+  while [ $retry -lt $max_retries ]; do
+    if curl -sf -o /dev/null "http://${host}:${port}/healthz" 2>/dev/null; then
+      echo "[apollo-router] ${name} is ready (http://${host}:${port})"
+      return 0
+    fi
+    retry=$((retry + 1))
+    echo "[apollo-router] Waiting for ${name} at ${host}:${port} (attempt ${retry}/${max_retries})"
+    sleep 3
+  done
+
+  echo "[apollo-router] WARNING: ${name} not ready after ${max_retries} attempts, continuing anyway..."
+  return 0
+}
+
+for entry in "${SUBGRAPHS[@]}"; do
+  name="${entry%%:*}"
+  hostport="${entry#*:}"
+  host="${hostport%%:*}"
+  port="${hostport##*:}"
+  wait_for_subgraph "$name" "$host" "$port"
+done
+
+# 组合 supergraph SDL
+echo "[apollo-router] Composing supergraph SDL..."
+export APOLLO_ELV2_LICENSE=accept
+
+max_compose_retries=5
+compose_retry=0
+while [ $compose_retry -lt $max_compose_retries ]; do
+  compose_retry=$((compose_retry + 1))
+  if rover supergraph compose --config /dist/supergraph.yaml --output /tmp/supergraph.graphql 2>&1; then
+    echo "[apollo-router] Supergraph composed successfully"
+    break
+  fi
+  echo "[apollo-router] Compose attempt ${compose_retry}/${max_compose_retries} failed, retrying in 5s..."
+  sleep 5
+done
+
+if [ ! -f /tmp/supergraph.graphql ]; then
+  echo "[apollo-router] ERROR: Failed to compose supergraph after ${max_compose_retries} attempts"
+  exit 1
+fi
+
+# 启动 router
+echo "[apollo-router] Starting Apollo Router on port 3000..."
+exec /router --config /dist/configuration.yaml --supergraph /tmp/supergraph.graphql --hot-reload

infra/apollo-router/router.yaml

@@ -0,0 +1,77 @@
+# Apollo Router 配置（v2.1 M2）
+#
+# Router 作为唯一的外部 GraphQL 入口，替代 3 个 BFF 的手动聚合。
+# 前端 → Router（GraphQL）→ 各子图（/graphql）
+# 内部调用（后端 → 后端）仍走 gRPC（ADR-037）。
+#
+# 端口：3000（NestJS BFF 段空闲端口）
+# 镜像：ghcr.io/apollographql/router
+
+supergraph:
+  listen: 0.0.0.0:3000
+  path: /graphql
+  introspection: true
+
+# Sandbox 模式：支持开发和调试
+homepage:
+  enabled: true
+  path: /
+
+# CORS：允许前端 portal 访问
+sandbox:
+  enabled: true
+
+cors:
+  origins:
+    - "http://localhost:4000"
+    - "http://localhost:4001"
+    - "http://localhost:4002"
+    - "http://localhost:4003"
+    - "http://teacher-portal:4000"
+    - "http://student-portal:4001"
+    - "http://parent-portal:4002"
+    - "http://admin-portal:4003"
+  methods:
+    - GET
+    - POST
+    - OPTIONS
+  headers:
+    - Authorization
+    - Content-Type
+    - X-Request-Id
+    - X-Expected-Version
+    - If-Match
+  credentials: true
+
+# 向所有子图注入 Router-Authorization Header（ADR-036）
+# 子图的 RouterAuthGuard 校验此 Header，拒绝非 Router 的直接 GraphQL 请求
+headers:
+  all:
+    request:
+      - add:
+          name: "router-authorization"
+          value: "${env.ROUTER_AUTH_SECRET}"
+
+# 流量控制
+traffic_shaping:
+  all:
+    router:
+      timeout: 30s
+    subgraph:
+      timeout: 10s
+      global_rate_limit:
+        capacity: 1000
+        interval: 1s
+
+# 健康检查
+health_check:
+  listen: 0.0.0.0:8088
+
+# 日志
+telemetry:
+  instrumentation:
+    spans:
+      mode: spec_compliant
+  logging:
+    level: info
+    format: json

infra/apollo-router/supergraph.yaml

@@ -0,0 +1,42 @@
+# Apollo Federation 2 Supergraph 组合配置
+#
+# 列出所有子图及其路由 URL，rover supergraph compose 使用此文件生成 supergraph SDL。
+# 子图 /graphql 端点必须返回 _service { sdl } 以支持内省组合。
+#
+# 生成命令：
+#   rover supergraph compose --config supergraph.yaml --output supergraph-schema.graphql
+#
+# v2.1 M2: apollo-router 替代 3 个 BFF 的手动聚合职责
+
+federation_version: =2.9.0
+
+subgraphs:
+  iam:
+    routing_url: http://iam:3002/graphql
+    schema:
+      subgraph_url: http://iam:3002/graphql
+
+  core-edu:
+    routing_url: http://core-edu:3004/graphql
+    schema:
+      subgraph_url: http://core-edu:3004/graphql
+
+  content:
+    routing_url: http://content:3005/graphql
+    schema:
+      subgraph_url: http://content:3005/graphql
+
+  msg:
+    routing_url: http://msg:3007/graphql
+    schema:
+      subgraph_url: http://msg:3007/graphql
+
+  ai:
+    routing_url: http://ai:3008/graphql
+    schema:
+      subgraph_url: http://ai:3008/graphql
+
+  data-ana:
+    routing_url: http://data-ana:3006/graphql
+    schema:
+      subgraph_url: http://data-ana:3006/graphql