feat: initialize parent-bff service with full core features

add complete parent-bff implementation including:
- GraphQL endpoint with depth/cost validation
- ChildGuard越权校验 with redis cache and singleflight
- parallel orchestration with partial failure fallback
- three-level cache fallback strategy (Redis + LRU + downstream)
- Kafka consumer for cache invalidation and notification push
- opossum circuit breaker for downstream services
- Prometheus metrics and SLO alerts
- Helm chart for k8s deployment with multi-environment configs
- Grafana dashboard for observability
- complete unit and integration tests

infra/k8s/helm/parent-bff/values.yaml

@@ -0,0 +1,104 @@
+# parent-bff 服务默认值
+
+# 副本数（生产建议 ≥ 2）
+replicaCount: 2
+
+image:
+  repository: edu/parent-bff
+  tag: latest  # 生产请固定 tag
+  pullPolicy: IfNotPresent
+
+# 服务端口（GraphQL :3010）
+service:
+  type: ClusterIP
+  port: 3010
+  targetPort: 3010
+
+# 命名空间
+namespace: edu-services
+
+# 探针配置
+probes:
+  liveness:
+    path: /healthz
+    initialDelaySeconds: 15
+    periodSeconds: 20
+    timeoutSeconds: 3
+    failureThreshold: 3
+  readiness:
+    path: /readyz
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 2
+
+# 资源配额
+resources:
+  requests:
+    cpu: 250m
+    memory: 256Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+
+# 滚动更新策略
+strategy:
+  type: RollingUpdate
+  maxSurge: 1
+  maxUnavailable: 0
+
+# Prometheus 指标采集
+metrics:
+  enabled: true
+  port: 3010
+  path: /metrics
+
+# 安全上下文
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: ["ALL"]
+
+# podAntiAffinity（跨节点分布）
+podAntiAffinity:
+  enabled: true
+  topologyKey: kubernetes.io/hostname
+
+# HPA
+hpa:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+
+# 服务级 ConfigMap（非敏感配置）
+configMap:
+  enabled: true
+  data:
+    NODE_ENV: production
+    LOG_LEVEL: info
+    DEV_MODE: "false"
+    PORT: "3010"
+    CORS_ORIGINS: https://parent.edu.example.com
+    REDIS_URL: redis://edu-redis.edu-system.svc.cluster.local:6379
+    IAM_GRPC_TARGET: iam.edu-services.svc.cluster.local:50052
+    CORE_EDU_GRPC_TARGET: core-edu.edu-services.svc.cluster.local:50053
+    DATA_ANA_GRPC_TARGET: data-ana.edu-services.svc.cluster.local:50055
+    MSG_GRPC_TARGET: msg.edu-services.svc.cluster.local:50056
+    PUSH_GATEWAY_URL: http://push-gateway.edu-services.svc.cluster.local:8081
+
+# 敏感配置
+secretRefs:
+  - name: edu-platform-secret
+    keys:
+      - REDIS_PASSWORD
+      - OTEL_EXPORTER_OTLP_ENDPOINT
+
+# Kafka
+kafka:
+  enabled: false  # P5+ 启用
+  brokers: ""
+  consumerGroupId: parent-bff