feat(portal-shell): implement portal-shell with apollo-router integration

M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).

- Apollo Client -> apollo-router (port 4010, RSC prefetch)

- 5 layouts: classic/focus/split/triple/canvas

- Registry + PluginLoader (dynamic import ssr:false)

- 3-layer props merge, Zustand PluginStore

- 4 widgets: grades/notification-bell/user-menu/class-selector

- config-service: new pluginConfig GraphQL resolver

- apollo-router: CORS + header propagation for portal-shell

- docker-compose.yml: portal-shell service block

apps/portal-shell/.eslintrc.tokens.js

@@ -0,0 +1,49 @@
+/**
+ * ESLint Design Tokens 配置（独立运行：eslint -c .eslintrc.tokens.js src）
+ *
+ * 与 eslint.config.js 中的 design-tokens 规则等价，保留以对齐 teacher-portal 习惯。
+ * 关联：project_rules §3.10
+ */
+let tsParser;
+try {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  tsParser = require("@typescript-eslint/parser");
+} catch {
+  tsParser = undefined;
+}
+
+/** @type {import('eslint').Linter.Config[]} */
+module.exports = [
+  {
+    files: ["**/*.{ts,tsx,js,jsx}"],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2024,
+      sourceType: "module",
+      parserOptions: {
+        ecmaFeatures: { jsx: true },
+      },
+    },
+    rules: {
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: 'Literal[value=/^#[0-9a-fA-F]{3,8}$/]',
+          message:
+            "禁止硬编码颜色 #hex，使用 var(--*) 或 Tailwind bg-* 类（project_rules §3.10）",
+        },
+        {
+          selector: 'Literal[value=/^(Inter|Fraunces|JetBrains Mono)$/]',
+          message:
+            "禁止硬编码字体名字面量，使用 var(--font-family-sans/serif/mono)（project_rules §3.10）",
+        },
+      ],
+    },
+  },
+  {
+    files: ["**/primitive.css", "**/manifest.ts"],
+    rules: {
+      "no-restricted-syntax": "off",
+    },
+  },
+];