feat(data-ana): python graphql federation subgraph with strawberry

- strawberry-graphql[asgi] dependency added

- 13 Federation 2 types: ClassPerformance/StudentWeakness/Dashboards/Mastery/ErrorBook

- 11 Query resolvers delegate to existing analytics/mastery services

- RouterAuthMiddleware validates Router-Authorization header on /graphql

- GraphQL endpoint mounted at /graphql alongside existing REST endpoints

services/data-ana/src/data_ana/config.py

@@ -84,6 +84,12 @@ class Settings(BaseSettings):
     readyz_iam_grpc_timeout_s: float = 2.0
     readyz_cdc_lag_threshold: int = 1000  # lag 超过此值判定 not_ready
 
+    # GraphQL Federation 2 子图（v2.1 M1，ADR-036）
+    # Apollo Router 请求子图时必须携带 Router-Authorization Header（共享密钥）
+    # 与 TS 服务使用相同的 secret（由 Secret 注入）
+    router_auth_secret: str = ""  # 留空则 /graphql 返回 403（除非 dev_mode=True）
+    graphql_path: str = "/graphql"  # GraphQL 端点路径
+
     # 向后兼容：旧代码引用 settings.port / settings.kafka_group_id
     @property
     def port(self) -> int: