feat(infra): enable apollo-router APQ + manifest + depth/cost limits

Task 14 of portal-shell data abstraction plan (M3 security).

router.yaml:
- persisted_queries: enabled + require_manifest (env-controlled)
- limits: max_depth=10, max_cost=1000, max_batch_size=5
- introspection: env-controlled (prod=false, dev=true)

docker-compose.yml:
- Mount portal-shell/public/pq-manifest.json as read-only volume
- Add APOLLO_REQUIRE_PQ_MANIFEST + APOLLO_ROUTER_INTROSPECTION env vars
- Dev defaults preserve current behavior (manifest optional)

entrypoint.sh:
- Pre-start check: if require_manifest=true, fail fast when manifest missing
- Dev mode: warn but continue when manifest absent

Production enables strict mode via env:
  APOLLO_REQUIRE_PQ_MANIFEST=true
  APOLLO_ROUTER_INTROSPECTION=false

infra/apollo-router/entrypoint.sh

@@ -68,6 +68,30 @@ if [ ! -f /tmp/supergraph.graphql ]; then
   exit 1
 fi
 
-# 启动 router
+# PQ manifest 检查（v2.1 M3 安全加固）
+# 关联：portal-shell spec §4.2、§4.3
+# - 生产模式（APOLLO_REQUIRE_PQ_MANIFEST=true）必须存在 manifest，否则启动失败
+# - 开发模式（APOLLO_REQUIRE_PQ_MANIFEST=false）manifest 不存在时仅警告
+MANIFEST_PATH="/etc/apollo-router/pq-manifest.json"
+REQUIRE_MANIFEST="${APOLLO_REQUIRE_PQ_MANIFEST:-false}"
+
+if [ "${REQUIRE_MANIFEST}" = "true" ]; then
+  if [ ! -f "${MANIFEST_PATH}" ]; then
+    echo "[apollo-router] ERROR: APOLLO_REQUIRE_PQ_MANIFEST=true but manifest not found at ${MANIFEST_PATH}"
+    echo "[apollo-router] Run 'pnpm --filter @edu/portal-shell run generate-pq-manifest' to generate it."
+    exit 1
+  fi
+  QUERY_COUNT=$(grep -c '"' "${MANIFEST_PATH}" 2>/dev/null || echo "0")
+  echo "[apollo-router] PQ manifest loaded (require_manifest=true): ${MANIFEST_PATH}"
+else
+  if [ ! -f "${MANIFEST_PATH}" ]; then
+    echo "[apollo-router] WARNING: PQ manifest not found at ${MANIFEST_PATH} (require_manifest=false, continuing)"
+    echo "[apollo-router] APQ will accept hash-only requests but cannot resolve unknown hashes."
+  else
+    echo "[apollo-router] PQ manifest loaded (require_manifest=false): ${MANIFEST_PATH}"
+  fi
+fi
+
+# 启动 router（router 二进制位于 /dist/router，由基础镜像 ghcr.io/apollographql/router 提供）
 echo "[apollo-router] Starting Apollo Router on port 3000..."
-exec /router --config /dist/configuration.yaml --supergraph /tmp/supergraph.graphql --hot-reload
+exec /dist/router --config /dist/configuration.yaml --supergraph /tmp/supergraph.graphql --hot-reload