feat(portal-shell): implement portal-shell with apollo-router integration

M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).

- Apollo Client -> apollo-router (port 4010, RSC prefetch)

- 5 layouts: classic/focus/split/triple/canvas

- Registry + PluginLoader (dynamic import ssr:false)

- 3-layer props merge, Zustand PluginStore

- 4 widgets: grades/notification-bell/user-menu/class-selector

- config-service: new pluginConfig GraphQL resolver

- apollo-router: CORS + header propagation for portal-shell

- docker-compose.yml: portal-shell service block

apps/portal-shell/Dockerfile

@@ -0,0 +1,56 @@
+# 多阶段构建：Next.js 生产镜像（standalone 模式）
+# 用法：docker build -t edu/portal-shell:latest -f apps/portal-shell/Dockerfile .
+# 端口规范：portal-shell :4010（避开旧 portal 4000-4003 段位）
+
+# ============ Builder ============
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+# 启用 pnpm
+RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
+
+# 先拷依赖清单，利用缓存（含 workspace 共享包）
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* tsconfig.base.json* ./
+COPY apps/portal-shell/package.json ./apps/portal-shell/
+COPY packages/ui-tokens/package.json ./packages/ui-tokens/
+COPY packages/ui-components/package.json ./packages/ui-components/
+COPY packages/hooks/package.json ./packages/hooks/
+# 安装依赖（含 devDependencies，构建需要）
+RUN pnpm install --filter @edu/portal-shell... --frozen-lockfile || pnpm install --filter @edu/portal-shell...
+
+# 拷源码
+COPY apps/portal-shell ./apps/portal-shell
+COPY packages/ui-tokens ./packages/ui-tokens
+COPY packages/ui-components ./packages/ui-components
+COPY packages/hooks ./packages/hooks
+
+# 构建（禁用 telemetry，生产模式，standalone 输出）
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN pnpm --filter @edu/portal-shell run build
+
+# ============ Runtime ============
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=4010
+
+# 非 root 用户运行
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+
+# 拷 standalone 产物（已含 node_modules 和 server.js，自包含）
+COPY --from=builder --chown=nextjs:nodejs /app/apps/portal-shell/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/apps/portal-shell/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/apps/portal-shell/public ./public
+
+USER nextjs
+EXPOSE 4010
+
+# 健康检查（/api/health liveness 端点）
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD wget --quiet --spider http://localhost:4010/api/health || exit 1
+
+# standalone 模式下直接用 node server.js 启动（已自包含所有依赖）
+WORKDIR /app/apps/portal-shell
+CMD ["node", "server.js"]