feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/apollo-router/router.yaml

@@ -0,0 +1,77 @@
+# Apollo Router 配置（v2.1 M2）
+#
+# Router 作为唯一的外部 GraphQL 入口，替代 3 个 BFF 的手动聚合。
+# 前端 → Router（GraphQL）→ 各子图（/graphql）
+# 内部调用（后端 → 后端）仍走 gRPC（ADR-037）。
+#
+# 端口：3000（NestJS BFF 段空闲端口）
+# 镜像：ghcr.io/apollographql/router
+
+supergraph:
+  listen: 0.0.0.0:3000
+  path: /graphql
+  introspection: true
+
+# Sandbox 模式：支持开发和调试
+homepage:
+  enabled: true
+  path: /
+
+# CORS：允许前端 portal 访问
+sandbox:
+  enabled: true
+
+cors:
+  origins:
+    - "http://localhost:4000"
+    - "http://localhost:4001"
+    - "http://localhost:4002"
+    - "http://localhost:4003"
+    - "http://teacher-portal:4000"
+    - "http://student-portal:4001"
+    - "http://parent-portal:4002"
+    - "http://admin-portal:4003"
+  methods:
+    - GET
+    - POST
+    - OPTIONS
+  headers:
+    - Authorization
+    - Content-Type
+    - X-Request-Id
+    - X-Expected-Version
+    - If-Match
+  credentials: true
+
+# 向所有子图注入 Router-Authorization Header（ADR-036）
+# 子图的 RouterAuthGuard 校验此 Header，拒绝非 Router 的直接 GraphQL 请求
+headers:
+  all:
+    request:
+      - add:
+          name: "router-authorization"
+          value: "${env.ROUTER_AUTH_SECRET}"
+
+# 流量控制
+traffic_shaping:
+  all:
+    router:
+      timeout: 30s
+    subgraph:
+      timeout: 10s
+      global_rate_limit:
+        capacity: 1000
+        interval: 1s
+
+# 健康检查
+health_check:
+  listen: 0.0.0.0:8088
+
+# 日志
+telemetry:
+  instrumentation:
+    spans:
+      mode: spec_compliant
+  logging:
+    level: info
+    format: json