feat(config-service): split config-service from iam for plugin/layout config

- new NestJS service on port 3011/gRPC 50059 (ADR-026)
- owns 6 config_ tables (plugin/role-mapping/role-layout/layout-tpl/user-override/outbox)
- GraphQL Federation 2 subgraph with DataLoader + RouterAuthGuard
- gRPC ConfigService + admin REST CRUD + user REST API
- three-layer merge: registry.defaultProps + roleMapping.widget_props + userOverride.props
- Redis cache with 5min TTL
- registered in apollo-router supergraph + docker-compose + port-allocation

Implements M3 of v2.1 migration plan.

services/config-service/src/graphql/resolvers/user-layout.resolver.ts

@@ -0,0 +1,54 @@
+/**
+ * UserLayoutOverride Resolver（v2.1 M3）
+ *
+ * Apollo Federation 子图：UserLayoutOverride Entity
+ * - @key(fields: "userId") 支持跨子图引用
+ * - @ResolveReference 使用 DataLoader 批量加载（ADR-035）
+ * - Query 入口供 Apollo Router 直接查询
+ */
+import {
+  Resolver,
+  Query,
+  Args,
+  ID,
+  ResolveReference,
+  ObjectType,
+  Field,
+  Directive,
+} from "@nestjs/graphql";
+import {
+  DataLoaderService,
+  type UserLayoutOverrideEntity,
+} from "../dataloader.service.js";
+
+@ObjectType()
+@Directive(`@key(fields: "userId")`)
+export class UserLayoutOverrideGql {
+  @Field(() => ID)
+  userId!: string;
+
+  @Field()
+  activeLayout!: string;
+
+  @Field()
+  updatedAt!: string;
+}
+
+@Resolver(() => UserLayoutOverrideGql)
+export class UserLayoutResolver {
+  constructor(private readonly loader: DataLoaderService) {}
+
+  @ResolveReference()
+  async resolveReference(ref: {
+    userId: string;
+  }): Promise<UserLayoutOverrideEntity | null> {
+    return this.loader.userLayoutLoader.load(ref.userId);
+  }
+
+  @Query(() => UserLayoutOverrideGql, { nullable: true })
+  async userLayoutOverride(
+    @Args("userId", { type: () => ID }) userId: string,
+  ): Promise<UserLayoutOverrideEntity | null> {
+    return this.loader.userLayoutLoader.load(userId);
+  }
+}