feat(portal-shell): implement portal-shell with apollo-router integration

M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).

- Apollo Client -> apollo-router (port 4010, RSC prefetch)

- 5 layouts: classic/focus/split/triple/canvas

- Registry + PluginLoader (dynamic import ssr:false)

- 3-layer props merge, Zustand PluginStore

- 4 widgets: grades/notification-bell/user-menu/class-selector

- config-service: new pluginConfig GraphQL resolver

- apollo-router: CORS + header propagation for portal-shell

- docker-compose.yml: portal-shell service block

apps/portal-shell/next.config.js

@@ -0,0 +1,52 @@
+/**
+ * portal-shell Next.js 配置（v2.1 M8）
+ *
+ * 角色：插件化仪表盘宿主（单 Next.js App Router · 单 Docker）
+ * - output: standalone（单容器部署）
+ * - transpilePackages: @edu/* workspace 包
+ * - 反向代理：/api/v1/* → api-gateway :8080（JWT 校验 + 注入 x-user-id/x-user-role）
+ * - GraphQL 查询走 apollo-router :3000（M8 验收点，由 Apollo Client 直连）
+ *
+ * 关联：portal-shell spec §2、project_rules §3.2
+ */
+
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  reactStrictMode: true,
+  output: "standalone",
+  transpilePackages: [
+    "@edu/ui-components",
+    "@edu/ui-tokens",
+    "@edu/hooks",
+    "@edu/contracts",
+    "@edu/shared-ts",
+  ],
+  experimental: {
+    serverActions: { bodySizeLimit: "2mb" },
+  },
+  webpack(config) {
+    // ESM 包使用 .js 后缀导入源码（TS 文件），需映射 .js → .ts
+    config.resolve = config.resolve || {};
+    config.resolve.extensionAlias = {
+      ...config.resolve.extensionAlias,
+      ".js": [".ts", ".tsx", ".js"],
+    };
+    return config;
+  },
+  async rewrites() {
+    const gateway =
+      process.env.API_GATEWAY_URL || "http://localhost:8080";
+    return [
+      {
+        source: "/api/v1/:path*",
+        destination: `${gateway}/api/v1/:path*`,
+      },
+      {
+        source: "/api/auth/:path*",
+        destination: `${gateway}/api/v1/iam/:path*`,
+      },
+    ];
+  },
+};
+
+module.exports = nextConfig;