feat(portal-shell): implement portal-shell with apollo-router integration

M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).

- Apollo Client -> apollo-router (port 4010, RSC prefetch)

- 5 layouts: classic/focus/split/triple/canvas

- Registry + PluginLoader (dynamic import ssr:false)

- 3-layer props merge, Zustand PluginStore

- 4 widgets: grades/notification-bell/user-menu/class-selector

- config-service: new pluginConfig GraphQL resolver

- apollo-router: CORS + header propagation for portal-shell

- docker-compose.yml: portal-shell service block

infra/apollo-router/router.yaml

@@ -27,10 +27,12 @@ cors:
     - "http://localhost:4001"
     - "http://localhost:4002"
     - "http://localhost:4003"
+    - "http://localhost:4010"
     - "http://teacher-portal:4000"
     - "http://student-portal:4001"
     - "http://parent-portal:4002"
     - "http://admin-portal:4003"
+    - "http://portal-shell:4010"
   methods:
     - GET
     - POST
@@ -45,12 +47,22 @@ cors:
 
 # 向所有子图注入 Router-Authorization Header（ADR-036）
 # 子图的 RouterAuthGuard 校验此 Header，拒绝非 Router 的直接 GraphQL 请求
+# 同时透传用户身份头（x-user-id / x-user-role）与 Authorization 到子图，
+# 供 iam/core-edu/msg 等子图做用户级鉴权（M8：portal-shell 查询走 Router）
 headers:
   all:
     request:
       - add:
           name: "router-authorization"
           value: "${env.ROUTER_AUTH_SECRET}"
+      - propagate:
+          named: "Authorization"
+      - propagate:
+          named: "x-user-id"
+      - propagate:
+          named: "x-user-role"
+      - propagate:
+          named: "X-Request-Id"
 
 # 流量控制
 traffic_shaping:

infra/docker-compose.yml

@@ -347,6 +347,36 @@ services:
       timeout: 5s
       retries: 5
   # ============================================================
+  # portal-shell - 统一前端壳（v2.1 M8）
+  # Modular Monolith + 微内核架构，端口 4010（避开 4000-4003 portal 段）
+  # 查询走 apollo-router（M8 验收标准），非 gRPC 直连
+  # ============================================================
+  portal-shell:
+    build:
+      context: ..
+      dockerfile: apps/portal-shell/Dockerfile
+    container_name: edu-portal-shell
+    profiles: ["p3", "p4", "p5", "p6"]
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      NEXT_PUBLIC_APOLLO_ROUTER_URL: http://apollo-router:3000/graphql
+      APOLLO_ROUTER_URL: http://apollo-router:3000/graphql
+      NEXT_PUBLIC_API_GATEWAY_URL: http://api-gateway:8080
+      NEXT_PUBLIC_REALTIME_GATEWAY_URL: http://realtime-gateway:8081
+      NEXT_PUBLIC_DEV_MODE: "true"
+    ports:
+      - "4010:4010"
+    depends_on:
+      apollo-router:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:4010/api/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+  # ============================================================
   # Temporal Server - AI 工作流引擎（v2.1 §8.2 ADR-030）
   # 仅用于 AI 耗时工作流 + Saga，CRUD 短事务禁止
   # ============================================================