feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/apollo-router/supergraph.yaml

@@ -0,0 +1,42 @@
+# Apollo Federation 2 Supergraph 组合配置
+#
+# 列出所有子图及其路由 URL，rover supergraph compose 使用此文件生成 supergraph SDL。
+# 子图 /graphql 端点必须返回 _service { sdl } 以支持内省组合。
+#
+# 生成命令：
+#   rover supergraph compose --config supergraph.yaml --output supergraph-schema.graphql
+#
+# v2.1 M2: apollo-router 替代 3 个 BFF 的手动聚合职责
+
+federation_version: =2.9.0
+
+subgraphs:
+  iam:
+    routing_url: http://iam:3002/graphql
+    schema:
+      subgraph_url: http://iam:3002/graphql
+
+  core-edu:
+    routing_url: http://core-edu:3004/graphql
+    schema:
+      subgraph_url: http://core-edu:3004/graphql
+
+  content:
+    routing_url: http://content:3005/graphql
+    schema:
+      subgraph_url: http://content:3005/graphql
+
+  msg:
+    routing_url: http://msg:3007/graphql
+    schema:
+      subgraph_url: http://msg:3007/graphql
+
+  ai:
+    routing_url: http://ai:3008/graphql
+    schema:
+      subgraph_url: http://ai:3008/graphql
+
+  data-ana:
+    routing_url: http://data-ana:3006/graphql
+    schema:
+      subgraph_url: http://data-ana:3006/graphql