feat(portal-shell): enable Apollo Client APQ + PQ manifest generator

Task 12-13 of portal-shell data abstraction plan (M3 security).

APQ (Automatic Persisted Queries):
- Add createPersistedQueryLink with sha256 to apollo-client.ts
- Production: client sends only query hash, not plaintext query
- Dev: NEXT_PUBLIC_APOLLO_APQ=false to disable for debugging
- Prevents attackers from crafting arbitrary queries via DevTools

PQ Manifest generator:
- New scripts/generate-pq-manifest.ts iterates operations barrel
- Outputs public/pq-manifest.json (sha256 -> query text whitelist)
- prebuild hook: codegen + generate-pq-manifest before next build
- 51 queries currently registered

- crypto-hash dependency added
- typecheck + lint (0 errors) + test (85/85) verified

apps/portal-shell/.env.example

@@ -9,6 +9,16 @@ NEXT_PUBLIC_APOLLO_ROUTER_URL=http://localhost:3000/graphql
 # 服务端 RSC 预取用（容器内走内部网络）
 APOLLO_ROUTER_URL=http://localhost:3000/graphql
 
+# Apollo Client APQ 开关（v2.1 M3 安全加固）
+# 生产环境必须为 true（前端只发 query hash，不发明文 query）
+# 开发环境可设为 false 便于 DevTools 调试
+NEXT_PUBLIC_APOLLO_APQ=true
+
+# config-service 直连地址（开发态降级用）
+# 当 apollo-router 不可用时，fetchPluginConfig 会降级直连此地址的 /graphql 端点
+# 生产环境不需要配置（apollo-router 必须可用）
+CONFIG_SERVICE_URL=http://localhost:3011
+
 # API Gateway（JWT 校验 + 注入 x-user-id / x-user-role）
 NEXT_PUBLIC_API_GATEWAY_URL=http://localhost:8080