feat(portal-shell): add CI structural checks for routes, pages, codegen (P1-8)

ARCHITECTURE.md §10 P1-8: three structural checks wired into CI to
prevent regressions identified in the §1.3 audit.

Scripts (apps/portal-shell/scripts/):
- check-route-table.ts: scans src/app/shell/**/page.tsx, parses
  route-permissions.ts (EXACT/PREFIX/DASHBOARD/PUBLIC_ROUTES), fails
  if any actual /shell/* route is unregistered. Reports ghost entries
  (EXACT declarations without page.tsx) as informational.
- check-page-count.ts: asserts total page.tsx >= 13 and per-category
  minimums (dashboards/login/root/forbidden/catch-all/dev-templates).
- check-codegen.ts: runs pnpm run codegen, fails if any output with
  skipDocumentsValidation:false has operations referencing non-existent
  schema fields (currently enforces dashboard-types.ts output from P1-7).

npm scripts: check:routes / check:pages / check:codegen / check:all

CI: .github/workflows/ci.yml quality-ts job — new "Portal-shell
structural checks (P1-8)" step between typecheck and test.

Acceptance (ARCHITECTURE.md §10 P1-8 — "CI 对预埋违规报红"):
- Route violation: planted /shell/test-violation/page.tsx → check:routes
  exits 1 with "unregistered route" error; reverted → PASS
- Codegen violation: planted non_existent_field in GetTeacherDashboard →
  check:codegen exits 1 with "Cannot query field" error; reverted → PASS
- Page count: baseline=13, deleting any page.tsx triggers FAIL
- Clean state: all 3 checks PASS (10 routes, 28 EXACT, 24 ghost entries
  informational, 13 pages, codegen 3 outputs SUCCESS)

Refs: ARCHITECTURE.md §5.3, §10 P1-8, §11.6, §11.7 红线 #5

apps/portal-shell/scripts/check-codegen.ts

@@ -0,0 +1,64 @@
+// Codegen contract validation check (ARCHITECTURE.md §10 P1-8 / §5.3)
+//
+// Runs graphql-codegen and fails if any output with skipDocumentsValidation:false
+// contains operations that reference non-existent schema fields.
+// This is the "codegen diff check" — it diffs operations against schema.
+//
+// Currently enforces:
+// - dashboard-types.ts output (skipDocumentsValidation: false, P1-7)
+// As more domains fix their operations, their outputs will be validated too.
+//
+// Usage: tsx scripts/check-codegen.ts
+// Exit: 0 = codegen success, 1 = validation errors
+//
+// Related: ARCHITECTURE.md §5.3 契约纪律, §10 P1-8
+import { execSync } from "node:child_process";
+
+function main(): void {
+  console.log("=== Codegen Contract Validation Check ===");
+  console.log("Running: pnpm run codegen (normalize-schema + graphql-codegen)");
+  console.log("");
+
+  try {
+    const output = execSync("pnpm run codegen", {
+      cwd: process.cwd(),
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    console.log(output);
+
+    // Check for validation failures even on exit 0 (some may be warnings)
+    if (output.includes("GraphQL Document Validation failed")) {
+      console.log("❌ Codegen reported validation failures despite exit 0");
+      console.log("Result: FAIL");
+      process.exit(1);
+    }
+
+    console.log(
+      "Result: PASS (codegen succeeded, all validated outputs clean)",
+    );
+    process.exit(0);
+  } catch (err: unknown) {
+    const e = err as { stdout?: string; stderr?: string; message: string };
+    const output = `${e.stdout ?? ""}\n${e.stderr ?? ""}`;
+    console.log(output);
+
+    if (output.includes("GraphQL Document Validation failed")) {
+      console.log(
+        "❌ Codegen validation failed — operations reference non-existent schema fields",
+      );
+      console.log(
+        "   Fix: update operations/*.graphql.ts to match combined-schema.graphql",
+      );
+      console.log(
+        "   Or: keep skipDocumentsValidation: true for that output until schema is ready",
+      );
+    } else {
+      console.log(`❌ Codegen failed: ${e.message}`);
+    }
+    console.log("Result: FAIL");
+    process.exit(1);
+  }
+}
+
+main();