feat(portal-shell): v2.0 P0 shadcn standardization + security + streaming + error handling

- shadcn/ui 标准化：废弃纸感令牌，统一 bg-background/text-foreground 等
- Tailwind v4 + @theme inline，移除 tailwind.config.js
- React 19 use() + Suspense 流式渲染，首屏骨架秒出
- 三级错误边界：Route → Section → Widget 层层兜底
- 错误上报：useErrorReport → sendBeacon → /api/log mock 端点
- 三层安全边界：L1 角色门禁 / L2 权限点门禁 / L3 数据范围
- 权限位图 base36 压缩：67 权限点 → ~14 字符，JWT 体积减少 ≥ 99%
- notify 统一 Toast 封装，禁止业务直接 import sonner
- PluginBoundary 替代 PluginLoader（错误边界 + Suspense + Skeleton 三件套）

验证：typecheck 0 错误 / lint 0 错误 / build 6 路由生成成功

infra/apollo-router/Dockerfile

@@ -13,7 +13,29 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # 安装 rover（Apollo CLI for supergraph composition）
-RUN curl -sSL https://rover.apollo.dev/nix/v0.30.0 | sh -s -- --install /usr/local/bin
+# 直接下载 release tarball 解压到 /usr/local/bin（避免 install 脚本参数兼容问题）
+# tarball 内 rover 位于 dist/rover 子目录
+RUN curl -sSL -o /tmp/rover.tar.gz https://github.com/apollographql/rover/releases/download/v0.30.0/rover-v0.30.0-x86_64-unknown-linux-gnu.tar.gz && \
+    mkdir -p /tmp/rover-extract && \
+    tar -xzf /tmp/rover.tar.gz -C /tmp/rover-extract && \
+    cp /tmp/rover-extract/dist/rover /usr/local/bin/rover && \
+    chmod +x /usr/local/bin/rover && \
+    rm -rf /tmp/rover.tar.gz /tmp/rover-extract && \
+    rover --version
+
+# 预下载 supergraph 插件（federation-rs supergraph v2.9.0）
+# 避免运行时因网络问题（如 GitHub 不可达）导致 rover compose 失败
+# 插件会被缓存到 /root/.rover/bin/supergraph-v2.9.0
+RUN APOLLO_ELV2_LICENSE=accept rover supergraph compose --config /dev/null --output /tmp/test-supergraph.graphql 2>&1 || \
+    (echo "[build] Pre-downloading supergraph plugin..." && \
+     curl -sSL -o /tmp/supergraph-plugin.tar.gz \
+       "https://github.com/apollographql/federation-rs/releases/download/supergraph%40v2.9.0/supergraph-v2.9.0-x86_64-unknown-linux-gnu.tar.gz" && \
+     mkdir -p /root/.rover/bin && \
+     tar -xzf /tmp/supergraph-plugin.tar.gz -C /root/.rover/bin/ && \
+     mv /root/.rover/bin/supergraph /root/.rover/bin/supergraph-v2.9.0 2>/dev/null || true && \
+     chmod +x /root/.rover/bin/supergraph-v2.9.0 && \
+     rm -f /tmp/supergraph-plugin.tar.gz /tmp/test-supergraph.graphql && \
+     echo "[build] Supergraph plugin pre-installed")
 
 # 接受 ELv2 许可
 ENV APOLLO_ELV2_LICENSE=accept