feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/docker-compose.yml

@@ -294,6 +294,30 @@ services:
     depends_on:
       redis:
         condition: service_started
+  apollo-router:
+    build:
+      context: ./apollo-router
+    container_name: edu-apollo-router
+    profiles: ["p3", "p4", "p5", "p6"]
+    restart: unless-stopped
+    environment:
+      ROUTER_AUTH_SECRET: ${ROUTER_AUTH_SECRET:-dev-router-secret}
+      APOLLO_ELV2_LICENSE: accept
+    ports:
+      - "3000:3000"
+      - "8088:8088"
+    depends_on:
+      - iam
+      - core-edu
+      - content
+      - msg
+      - ai
+      - data-ana
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8088/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
 volumes:
   mysql_data:
   redis_data: