feat(portal-shell): implement portal-shell with apollo-router integration

M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).

- Apollo Client -> apollo-router (port 4010, RSC prefetch)

- 5 layouts: classic/focus/split/triple/canvas

- Registry + PluginLoader (dynamic import ssr:false)

- 3-layer props merge, Zustand PluginStore

- 4 widgets: grades/notification-bell/user-menu/class-selector

- config-service: new pluginConfig GraphQL resolver

- apollo-router: CORS + header propagation for portal-shell

- docker-compose.yml: portal-shell service block

apps/portal-shell/eslint.config.js

@@ -0,0 +1,93 @@
+/**
+ * portal-shell ESLint flat config
+ *
+ * 包含设计令牌强制规则（project_rules §3.10）：
+ * - 禁止 #hex 颜色字面量
+ * - 禁止 'Inter'/'Fraunces'/'JetBrains Mono' 字体名字面量
+ *
+ * 关联：project_rules §3.10、portal-shell spec §7
+ */
+const js = require("@eslint/js");
+const tseslint = require("typescript-eslint");
+const prettierConfig = require("eslint-config-prettier");
+
+module.exports = tseslint.config(
+  {
+    ignores: [
+      "**/dist/**",
+      "**/node_modules/**",
+      "**/.next/**",
+      "**/coverage/**",
+      "**/*.config.js",
+      "**/*.config.mjs",
+    ],
+  },
+
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+
+  {
+    languageOptions: {
+      ecmaVersion: 2024,
+      sourceType: "module",
+    },
+    rules: {
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          argsIgnorePattern: "^_",
+          varsIgnorePattern: "^_",
+        },
+      ],
+      "no-console": "off",
+    },
+  },
+
+  // 设计令牌强制规则（project_rules §3.10）
+  {
+    files: ["**/*.{ts,tsx,js,jsx}"],
+    rules: {
+      "no-restricted-syntax": [
+        "error",
+        {
+          // 禁止 #hex 颜色字面量（如 "#fff"、"#000000"）
+          selector: "Literal[value=/^#[0-9a-fA-F]{3,8}$/]",
+          message:
+            "禁止硬编码颜色 #hex，使用 var(--*) 或 Tailwind bg-* 类（project_rules §3.10）",
+        },
+        {
+          // 禁止字体名字面量（next/font 的 import 标识符不受影响）
+          selector: "Literal[value=/^(Inter|Fraunces|JetBrains Mono)$/]",
+          message:
+            "禁止硬编码字体名字面量，使用 var(--font-family-sans/serif/mono)（project_rules §3.10）",
+        },
+      ],
+    },
+  },
+
+  // 白名单：令牌原始定义、PWA manifest
+  {
+    files: ["**/primitive.css", "**/manifest.ts"],
+    rules: {
+      "no-restricted-syntax": "off",
+    },
+  },
+
+  // 测试文件放宽规则
+  {
+    files: [
+      "**/*.test.ts",
+      "**/*.test.tsx",
+      "**/*.spec.ts",
+      "**/*.spec.tsx",
+      "**/__tests__/**",
+    ],
+    rules: {
+      "@typescript-eslint/no-explicit-any": "off",
+      "@typescript-eslint/no-non-null-assertion": "off",
+    },
+  },
+
+  prettierConfig,
+);