feat(portal-shell): enable Apollo Client APQ + PQ manifest generator

Task 12-13 of portal-shell data abstraction plan (M3 security).

APQ (Automatic Persisted Queries):
- Add createPersistedQueryLink with sha256 to apollo-client.ts
- Production: client sends only query hash, not plaintext query
- Dev: NEXT_PUBLIC_APOLLO_APQ=false to disable for debugging
- Prevents attackers from crafting arbitrary queries via DevTools

PQ Manifest generator:
- New scripts/generate-pq-manifest.ts iterates operations barrel
- Outputs public/pq-manifest.json (sha256 -> query text whitelist)
- prebuild hook: codegen + generate-pq-manifest before next build
- 51 queries currently registered

- crypto-hash dependency added
- typecheck + lint (0 errors) + test (85/85) verified

apps/portal-shell/package.json

@@ -12,13 +12,16 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "codegen": "tsx scripts/normalize-schema.ts && graphql-codegen --config codegen.yml",
-    "codegen:watch": "graphql-codegen --config codegen.yml --watch"
+    "codegen:watch": "graphql-codegen --config codegen.yml --watch",
+    "generate-pq-manifest": "tsx scripts/generate-pq-manifest.ts",
+    "prebuild": "pnpm run codegen && pnpm run generate-pq-manifest"
   },
   "dependencies": {
     "@apollo/client": "^3.11.0",
     "@edu/hooks": "workspace:*",
     "@edu/ui-components": "workspace:*",
     "@edu/ui-tokens": "workspace:*",
+    "crypto-hash": "^4.0.1",
     "graphql": "^16.8.0",
     "next": "^14.2.0",
     "react": "^18.3.0",