feat(config-service): split config-service from iam for plugin/layout config

- new NestJS service on port 3011/gRPC 50059 (ADR-026)
- owns 6 config_ tables (plugin/role-mapping/role-layout/layout-tpl/user-override/outbox)
- GraphQL Federation 2 subgraph with DataLoader + RouterAuthGuard
- gRPC ConfigService + admin REST CRUD + user REST API
- three-layer merge: registry.defaultProps + roleMapping.widget_props + userOverride.props
- Redis cache with 5min TTL
- registered in apollo-router supergraph + docker-compose + port-allocation

Implements M3 of v2.1 migration plan.

services/config-service/src/graphql/resolvers/layout-template.resolver.ts

@@ -0,0 +1,39 @@
+/**
+ * LayoutTemplate Resolver（v2.1 M3）
+ *
+ * Apollo Federation 子图：LayoutTemplate Entity（无 @key，仅 Query）
+ * - layoutTemplates: [LayoutTemplate!]!
+ */
+import { Resolver, Query, ObjectType, Field, ID } from "@nestjs/graphql";
+import { ConfigService } from "../../config-config/config.service.js";
+
+@ObjectType()
+export class LayoutTemplateGql {
+  @Field(() => ID)
+  layoutId!: string;
+
+  @Field()
+  displayName!: string;
+
+  @Field({ nullable: true })
+  description: string | null = null;
+
+  @Field()
+  isActive!: boolean;
+}
+
+@Resolver(() => LayoutTemplateGql)
+export class LayoutTemplateResolver {
+  constructor(private readonly service: ConfigService) {}
+
+  @Query(() => [LayoutTemplateGql])
+  async layoutTemplates(): Promise<LayoutTemplateGql[]> {
+    const templates = await this.service.listLayoutTemplates();
+    return templates.map((t) => ({
+      layoutId: t.layoutId,
+      displayName: t.displayName,
+      description: t.description,
+      isActive: t.isActive,
+    }));
+  }
+}

services/config-service/src/graphql/resolvers/plugin.resolver.ts

@@ -0,0 +1,84 @@
+/**
+ * PluginRegistry Resolver（v2.1 M3）
+ *
+ * Apollo Federation 子图：PluginRegistry Entity
+ * - @key(fields: "pluginId") 支持跨子图引用
+ * - @ResolveReference 使用 DataLoader 批量加载（ADR-035）
+ * - Query 入口供 Apollo Router 直接查询
+ */
+import {
+  Resolver,
+  Query,
+  Args,
+  ID,
+  ResolveReference,
+  ObjectType,
+  Field,
+  Directive,
+} from "@nestjs/graphql";
+import {
+  DataLoaderService,
+  type PluginRegistryEntity,
+} from "../dataloader.service.js";
+import { ConfigService } from "../../config-config/config.service.js";
+
+@ObjectType()
+@Directive(`@key(fields: "pluginId")`)
+export class PluginRegistry {
+  @Field(() => ID)
+  pluginId!: string;
+
+  @Field()
+  category!: string;
+
+  @Field()
+  version!: string;
+
+  @Field()
+  displayName!: string;
+
+  @Field()
+  description!: string;
+
+  @Field()
+  isBuiltin!: boolean;
+
+  @Field()
+  isActive!: boolean;
+}
+
+@Resolver(() => PluginRegistry)
+export class PluginResolver {
+  constructor(
+    private readonly loader: DataLoaderService,
+    private readonly service: ConfigService,
+  ) {}
+
+  @ResolveReference()
+  async resolveReference(ref: {
+    pluginId: string;
+  }): Promise<PluginRegistryEntity | null> {
+    return this.loader.pluginLoader.load(ref.pluginId);
+  }
+
+  @Query(() => PluginRegistry, { nullable: true })
+  async plugin(
+    @Args("pluginId", { type: () => ID }) pluginId: string,
+  ): Promise<PluginRegistryEntity | null> {
+    return this.loader.pluginLoader.load(pluginId);
+  }
+
+  @Query(() => [PluginRegistry])
+  async plugins(): Promise<PluginRegistryEntity[]> {
+    const list = await this.service.listPlugins({ isActive: true });
+    return list.map((p) => ({
+      pluginId: p.pluginId,
+      category: p.category,
+      version: p.version ?? "",
+      displayName: p.displayName,
+      description: p.description ?? "",
+      isBuiltin: p.isBuiltin,
+      isActive: p.isActive,
+    }));
+  }
+}

services/config-service/src/graphql/resolvers/user-layout.resolver.ts

@@ -0,0 +1,54 @@
+/**
+ * UserLayoutOverride Resolver（v2.1 M3）
+ *
+ * Apollo Federation 子图：UserLayoutOverride Entity
+ * - @key(fields: "userId") 支持跨子图引用
+ * - @ResolveReference 使用 DataLoader 批量加载（ADR-035）
+ * - Query 入口供 Apollo Router 直接查询
+ */
+import {
+  Resolver,
+  Query,
+  Args,
+  ID,
+  ResolveReference,
+  ObjectType,
+  Field,
+  Directive,
+} from "@nestjs/graphql";
+import {
+  DataLoaderService,
+  type UserLayoutOverrideEntity,
+} from "../dataloader.service.js";
+
+@ObjectType()
+@Directive(`@key(fields: "userId")`)
+export class UserLayoutOverrideGql {
+  @Field(() => ID)
+  userId!: string;
+
+  @Field()
+  activeLayout!: string;
+
+  @Field()
+  updatedAt!: string;
+}
+
+@Resolver(() => UserLayoutOverrideGql)
+export class UserLayoutResolver {
+  constructor(private readonly loader: DataLoaderService) {}
+
+  @ResolveReference()
+  async resolveReference(ref: {
+    userId: string;
+  }): Promise<UserLayoutOverrideEntity | null> {
+    return this.loader.userLayoutLoader.load(ref.userId);
+  }
+
+  @Query(() => UserLayoutOverrideGql, { nullable: true })
+  async userLayoutOverride(
+    @Args("userId", { type: () => ID }) userId: string,
+  ): Promise<UserLayoutOverrideEntity | null> {
+    return this.loader.userLayoutLoader.load(userId);
+  }
+}