feat(iam): graphql subgraph with dataloader and router auth guard

- GraphQLModule: Apollo Federation 2 subgraph at /graphql

- UserResolver/RoleResolver: @key with @ResolveReference using DataLoader (ADR-035)

- DataScopeResolver: ScopeToken for visible class/student IDs (ADR-041)

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- DataLoaderService: REQUEST-scoped userLoader + roleLoader

- IamRepository.batchFindRoles: batch query for DataLoader

- IamService.getVisibleClassIds/getVisibleStudentIds: dataScope calculation

- app.module.ts: register PermissionGuard + RouterAuthGuard as APP_GUARD

services/iam/package.json

@@ -12,11 +12,14 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@apollo/subgraph": "^2.2.3",
     "@edu/shared-ts": "workspace:*",
     "@grpc/grpc-js": "^1.12.0",
     "@grpc/proto-loader": "^0.7.13",
+    "@nestjs/apollo": "^12.2.0",
     "@nestjs/common": "^10.4.0",
     "@nestjs/core": "^10.4.0",
+    "@nestjs/graphql": "^12.2.0",
     "@nestjs/microservices": "^10.4.0",
     "@nestjs/platform-express": "^10.4.0",
     "@opentelemetry/api": "^1.9.0",
@@ -24,7 +27,9 @@
     "@opentelemetry/exporter-trace-otlp-http": "^0.53.0",
     "@opentelemetry/sdk-node": "^0.53.0",
     "bcrypt": "^5.1.0",
+    "dataloader": "^2.2.2",
     "drizzle-orm": "^0.31.0",
+    "graphql": "^16.9.0",
     "ioredis": "^5.4.0",
     "jsonwebtoken": "^9.0.0",
     "kafkajs": "^2.2.4",