feat(infra): apollo router deployment and supergraph composition

M2: Apollo Router replaces BFF manual aggregation (ADR-037)

- Dockerfile: self-contained with rover + router, auto-compose on startup

- router.yaml: CORS, Router-Authorization header injection, traffic shaping

- supergraph.yaml: 6 subgraphs (iam/core-edu/content/msg/ai/data-ana)

- docker-compose: apollo-router on port 3000, depends on all subgraphs

- ROUTER_AUTH_SECRET added to secrets.example.env

- port-allocation.md: apollo-router registered on port 3000

infra/security/secrets.example.env

@@ -48,3 +48,10 @@ REDIS_PASSWORD=<replace-with-24-char-redis-password>
 # 生成：openssl rand -base64 32
 # 注意：旋转前需先解密所有已加密字段，旋转后重新加密
 ENCRYPTION_KEY=<replace-with-base64-32-byte-aes-key>
+
+# ---------- Apollo Router 信任凭证 ----------
+# 用途：Router → 子图的共享密钥，子图 RouterAuthGuard 校验此 Header
+# 最小长度：32 字符
+# 生成：openssl rand -hex 32
+# 注意：Router 和所有子图必须使用相同的密钥
+ROUTER_AUTH_SECRET=<replace-with-32-char-router-auth-secret>