feat(portal-shell): v2.0 P0 shadcn standardization + security + streaming + error handling

- shadcn/ui 标准化：废弃纸感令牌，统一 bg-background/text-foreground 等
- Tailwind v4 + @theme inline，移除 tailwind.config.js
- React 19 use() + Suspense 流式渲染，首屏骨架秒出
- 三级错误边界：Route → Section → Widget 层层兜底
- 错误上报：useErrorReport → sendBeacon → /api/log mock 端点
- 三层安全边界：L1 角色门禁 / L2 权限点门禁 / L3 数据范围
- 权限位图 base36 压缩：67 权限点 → ~14 字符，JWT 体积减少 ≥ 99%
- notify 统一 Toast 封装，禁止业务直接 import sonner
- PluginBoundary 替代 PluginLoader（错误边界 + Suspense + Skeleton 三件套）

验证：typecheck 0 错误 / lint 0 错误 / build 6 路由生成成功

infra/apollo-router/dev-entrypoint.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Apollo Router 开发态启动脚本
+#
+# 与 entrypoint.sh 的差异：
+# - 跳过子图等待（子图已在 host 上运行）
+# - 使用 dev-supergraph.yaml（host.docker.internal）
+# - 容器需 --add-host=host.docker.internal:host-gateway
+#
+# 使用：
+#   docker run -d --name edu-apollo-router \
+#     --add-host=host.docker.internal:host-gateway \
+#     -p 3000:3000 -p 8088:8088 \
+#     -v $(pwd)/dev-supergraph.yaml:/dist/supergraph.yaml \
+#     -v $(pwd)/dev-entrypoint.sh:/dist/entrypoint.sh \
+#     -v $(pwd)/router.yaml:/dist/configuration.yaml \
+#     -e ROUTER_AUTH_SECRET=dev-router-secret \
+#     -e APOLLO_ELV2_LICENSE=accept \
+#     ghcr.io/apollographql/router:v1.45.0 \
+#     /dist/entrypoint.sh
+
+set -e
+
+echo "[apollo-router:dev] Dev mode - skipping subgraph wait (subgraphs run on host)"
+
+# 组合 supergraph SDL
+echo "[apollo-router:dev] Composing supergraph SDL..."
+export APOLLO_ELV2_LICENSE=accept
+
+max_compose_retries=5
+compose_retry=0
+while [ $compose_retry -lt $max_compose_retries ]; do
+  compose_retry=$((compose_retry + 1))
+  if rover supergraph compose --config /dist/supergraph.yaml --output /tmp/supergraph.graphql 2>&1; then
+    echo "[apollo-router:dev] Supergraph composed successfully"
+    break
+  fi
+  echo "[apollo-router:dev] Compose attempt ${compose_retry}/${max_compose_retries} failed, retrying in 5s..."
+  sleep 5
+done
+
+if [ ! -f /tmp/supergraph.graphql ]; then
+  echo "[apollo-router:dev] ERROR: Failed to compose supergraph after ${max_compose_retries} attempts"
+  exit 1
+fi
+
+# 启动 router（router 二进制位于 /dist/router，由基础镜像 ghcr.io/apollographql/router 提供）
+echo "[apollo-router:dev] Starting Apollo Router on port 3000..."
+exec /dist/router --config /dist/configuration.yaml --supergraph /tmp/supergraph.graphql --hot-reload