feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/apollo-router/Dockerfile

@@ -0,0 +1,29 @@
+# Apollo Router Dockerfile (v2.1 M2)
+#
+# 自包含镜像：rover（组合 supergraph）+ apollo-router（运行时）
+# 启动时自动等待子图就绪 → rover compose → 启动 router
+
+FROM ghcr.io/apollographql/router:v1.45.0
+
+USER root
+
+# 安装 curl（healthcheck + rover 下载）
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# 安装 rover（Apollo CLI for supergraph composition）
+RUN curl -sSL https://rover.apollo.dev/nix/v0.30.0 | sh -s -- --install /usr/local/bin
+
+# 接受 ELv2 许可
+ENV APOLLO_ELV2_LICENSE=accept
+
+# 复制配置文件
+COPY router.yaml /dist/configuration.yaml
+COPY supergraph.yaml /dist/supergraph.yaml
+COPY entrypoint.sh /dist/entrypoint.sh
+RUN chmod +x /dist/entrypoint.sh
+
+EXPOSE 3000 8088
+
+ENTRYPOINT ["/dist/entrypoint.sh"]