feat(portal-shell): add CI structural checks for routes, pages, codegen (P1-8)

ARCHITECTURE.md §10 P1-8: three structural checks wired into CI to
prevent regressions identified in the §1.3 audit.

Scripts (apps/portal-shell/scripts/):
- check-route-table.ts: scans src/app/shell/**/page.tsx, parses
  route-permissions.ts (EXACT/PREFIX/DASHBOARD/PUBLIC_ROUTES), fails
  if any actual /shell/* route is unregistered. Reports ghost entries
  (EXACT declarations without page.tsx) as informational.
- check-page-count.ts: asserts total page.tsx >= 13 and per-category
  minimums (dashboards/login/root/forbidden/catch-all/dev-templates).
- check-codegen.ts: runs pnpm run codegen, fails if any output with
  skipDocumentsValidation:false has operations referencing non-existent
  schema fields (currently enforces dashboard-types.ts output from P1-7).

npm scripts: check:routes / check:pages / check:codegen / check:all

CI: .github/workflows/ci.yml quality-ts job — new "Portal-shell
structural checks (P1-8)" step between typecheck and test.

Acceptance (ARCHITECTURE.md §10 P1-8 — "CI 对预埋违规报红"):
- Route violation: planted /shell/test-violation/page.tsx → check:routes
  exits 1 with "unregistered route" error; reverted → PASS
- Codegen violation: planted non_existent_field in GetTeacherDashboard →
  check:codegen exits 1 with "Cannot query field" error; reverted → PASS
- Page count: baseline=13, deleting any page.tsx triggers FAIL
- Clean state: all 3 checks PASS (10 routes, 28 EXACT, 24 ghost entries
  informational, 13 pages, codegen 3 outputs SUCCESS)

Refs: ARCHITECTURE.md §5.3, §10 P1-8, §11.6, §11.7 红线 #5

apps/portal-shell/scripts/check-page-count.ts

@@ -0,0 +1,160 @@
+// Page count baseline check (ARCHITECTURE.md §10 P1-8 / §11.6)
+//
+// Asserts that the total page.tsx count never drops below the baseline.
+// Prevents accidental route deletion. When adding new pages, update the
+// baseline in BASELINE.total. Per-category minimums catch regressions
+// in specific areas (dashboards, login, etc.).
+//
+// Usage: tsx scripts/check-page-count.ts
+// Exit: 0 = pass, 1 = below baseline
+//
+// Related: ARCHITECTURE.md §10 P1-8, §11.6 验收纪律
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+const APP_DIR = path.resolve(process.cwd(), "src/app");
+
+interface Baseline {
+  total: number;
+  categories: Record<string, { pattern: string; min: number; label: string }>;
+}
+
+// Baseline as of P1-8 (2026-07-22). Update when adding pages.
+const BASELINE: Baseline = {
+  total: 13,
+  categories: {
+    dashboards: {
+      pattern: "shell/{admin,teacher,student,parent}/page.tsx",
+      min: 4,
+      label: "Role dashboards (admin/teacher/student/parent)",
+    },
+    login: {
+      pattern: "login/page.tsx",
+      min: 1,
+      label: "Login page",
+    },
+    root: {
+      pattern: "page.tsx",
+      min: 1,
+      label: "Root redirect page",
+    },
+    forbidden: {
+      pattern: "shell/forbidden/page.tsx",
+      min: 1,
+      label: "Forbidden page",
+    },
+    catchAll: {
+      pattern: "shell/[[...route]]/page.tsx",
+      min: 1,
+      label: "Shell catch-all",
+    },
+    devTemplates: {
+      pattern: "shell/dev/templates/**/page.tsx",
+      min: 5,
+      label: "Dev template pages",
+    },
+  },
+};
+
+function scanPages(): string[] {
+  const pages: string[] = [];
+
+  function walk(dir: string, base: string): void {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      const rel = path.relative(base, full).replace(/\\/g, "/");
+      if (entry.isDirectory()) {
+        walk(full, base);
+      } else if (entry.name === "page.tsx") {
+        pages.push(rel);
+      }
+    }
+  }
+
+  walk(APP_DIR, APP_DIR);
+  return pages.sort();
+}
+
+function matchGlob(pattern: string, relPath: string): boolean {
+  // Glob → regex: ** (any path), * (within segment), {a,b} (alternation)
+  let result = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*" && pattern[i + 1] === "*") {
+      // ** — match anything including /; skip trailing /
+      result += ".*";
+      i += 2;
+      if (pattern[i] === "/") i++;
+    } else if (c === "*") {
+      result += "[^/]*";
+      i++;
+    } else if (c === "{") {
+      const end = pattern.indexOf("}", i);
+      if (end === -1) {
+        result += "\\{";
+        i++;
+      } else {
+        const opts = pattern
+          .slice(i + 1, end)
+          .split(",")
+          .map((s) => s.trim());
+        result += `(${opts.join("|")})`;
+        i = end + 1;
+      }
+    } else if (".+?^$()[]|\\".includes(c)) {
+      result += `\\${c}`;
+      i++;
+    } else {
+      result += c;
+      i++;
+    }
+  }
+  return new RegExp(`^${result}$`).test(relPath);
+}
+
+function main(): void {
+  const pages = scanPages();
+  const total = pages.length;
+
+  console.log("=== Page Count Baseline Check ===");
+  console.log(`Total page.tsx files: ${total} (baseline: ${BASELINE.total})`);
+  console.log("");
+
+  // Per-category check
+  let categoryFail = false;
+  for (const [, cat] of Object.entries(BASELINE.categories)) {
+    const matched = pages.filter((p) => matchGlob(cat.pattern, p));
+    const count = matched.length;
+    const status = count >= cat.min ? "✅" : "❌";
+    if (count < cat.min) categoryFail = true;
+    console.log(`  ${status} ${cat.label}: ${count} (min ${cat.min})`);
+  }
+  console.log("");
+
+  // Total check
+  const totalOk = total >= BASELINE.total;
+  if (!totalOk) {
+    console.log(`❌ Total ${total} < baseline ${BASELINE.total}`);
+  }
+
+  // List all pages
+  console.log("Pages:");
+  for (const p of pages) {
+    console.log(
+      `  /${p.replace(/\/page\.tsx$/, "").replace(/^page\.tsx$/, "")}`,
+    );
+  }
+  console.log("");
+
+  if (!totalOk || categoryFail) {
+    console.log("Result: FAIL");
+    process.exit(1);
+  } else {
+    console.log(`Result: PASS (${total} pages, all categories meet minimum)`);
+    process.exit(0);
+  }
+}
+
+main();