feat(config-service): split config-service from iam for plugin/layout config

- new NestJS service on port 3011/gRPC 50059 (ADR-026)
- owns 6 config_ tables (plugin/role-mapping/role-layout/layout-tpl/user-override/outbox)
- GraphQL Federation 2 subgraph with DataLoader + RouterAuthGuard
- gRPC ConfigService + admin REST CRUD + user REST API
- three-layer merge: registry.defaultProps + roleMapping.widget_props + userOverride.props
- Redis cache with 5min TTL
- registered in apollo-router supergraph + docker-compose + port-allocation

Implements M3 of v2.1 migration plan.

.commitlintrc.js

@@ -1,4 +1,4 @@
-module.exports = {
+module.exports = {
   extends: ['@commitlint/config-conventional'],
   rules: {
     'type-enum': [
@@ -12,6 +12,7 @@
       [
         'api-gateway', 'push-gateway',
         'iam', 'core-edu', 'classes', 'content', 'data-ana', 'msg', 'ai',
+        'config-service',
         'teacher-bff', 'student-bff', 'parent-bff',
         'teacher-portal', 'student-portal', 'parent-portal', 'admin-portal',
         'shared-proto', 'shared-ts', 'shared-go', 'shared-py', 'shared-tokens',