feat(core-edu): graphql subgraph with dataloader for exam/homework/grade/class

- GraphQLModule: Apollo Federation 2 at /graphql

- Exam/Homework/Grade/ClassInfo @key with @ResolveReference using DataLoader

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- batchFind methods added to exams/homework/grades/classes repositories

- Domain modules export repositories for GraphqlModule injection

services/core-edu/src/graphql/router-auth.guard.ts

@@ -0,0 +1,34 @@
+/**
+ * core-edu RouterAuthGuard 包装（v2.1 ADR-036）
+ *
+ * 仅作用于 /graphql 端点，REST 路由放行（已有 PermissionGuard）。
+ */
+import { Injectable, ExecutionContext } from "@nestjs/common";
+import {
+  RouterAuthGuard as BaseRouterAuthGuard,
+  type RouterAuthConfig,
+} from "@edu/shared-ts/federation";
+
+@Injectable()
+export class RouterAuthGuard extends BaseRouterAuthGuard {
+  constructor() {
+    const config: RouterAuthConfig = {
+      secret: process.env.ROUTER_AUTH_SECRET ?? "",
+      devMode: process.env.DEV_MODE === "true",
+    };
+    super(config);
+  }
+
+  override canActivate(ctx: ExecutionContext): boolean {
+    const req = ctx.switchToHttp().getRequest<{
+      url: string;
+    }>();
+
+    // 仅 GraphQL 端点需要校验，REST 路由放行
+    if (!req.url?.startsWith("/graphql")) {
+      return true;
+    }
+
+    return super.canActivate(ctx);
+  }
+}