feat(config-service): split config-service from iam for plugin/layout config

- new NestJS service on port 3011/gRPC 50059 (ADR-026)
- owns 6 config_ tables (plugin/role-mapping/role-layout/layout-tpl/user-override/outbox)
- GraphQL Federation 2 subgraph with DataLoader + RouterAuthGuard
- gRPC ConfigService + admin REST CRUD + user REST API
- three-layer merge: registry.defaultProps + roleMapping.widget_props + userOverride.props
- Redis cache with 5min TTL
- registered in apollo-router supergraph + docker-compose + port-allocation

Implements M3 of v2.1 migration plan.

services/config-service/Dockerfile

@@ -0,0 +1,54 @@
+# Build stage
+FROM node:22-alpine AS builder
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
+
+# 复制 workspace 配置 + tsconfig 基线
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
+
+# 复制 shared-proto（gRPC proto-loader 运行时加载）
+COPY packages/shared-proto ./packages/shared-proto
+
+# 复制 shared-ts（workspace 依赖）
+COPY packages/shared-ts ./packages/shared-ts
+
+# 复制 config-service 源码
+COPY services/config-service ./services/config-service
+
+# HUSKY=0 跳过根 package.json 的 prepare:husky 脚本
+ENV HUSKY=0
+
+# 只安装 config-service 及其 workspace 依赖（@edu/shared-ts、@edu/shared-proto）
+RUN pnpm install --no-frozen-lockfile --filter @edu/config-service...
+
+# 构建 shared-ts（config-service 依赖 @edu/shared-ts/outbox dist 产物）
+RUN cd packages/shared-ts && pnpm build
+
+# 构建 config-service
+WORKDIR /app/services/config-service
+RUN pnpm build
+
+# Runtime stage
+FROM node:22-alpine
+WORKDIR /app
+
+# 复制 workspace 配置 + tsconfig 基线
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
+
+# 复制 shared-proto + shared-ts（运行时需要：proto 文件 + shared-ts dist）
+COPY packages/shared-proto ./packages/shared-proto
+COPY packages/shared-ts ./packages/shared-ts
+
+# 复制 config-service 源码
+COPY services/config-service ./services/config-service
+
+# 从 builder 复制已编译的 prod node_modules + config-service dist + shared-ts dist
+COPY --from=builder /app/services/config-service/node_modules ./services/config-service/node_modules
+COPY --from=builder /app/packages/shared-ts/node_modules ./packages/shared-ts/node_modules
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/services/config-service/dist ./services/config-service/dist
+COPY --from=builder /app/packages/shared-ts/dist ./packages/shared-ts/dist
+
+WORKDIR /app/services/config-service
+EXPOSE 3011 50059
+CMD ["node", "dist/main.js"]