feat(infra): enable apollo-router APQ + manifest + depth/cost limits

Task 14 of portal-shell data abstraction plan (M3 security).

router.yaml:
- persisted_queries: enabled + require_manifest (env-controlled)
- limits: max_depth=10, max_cost=1000, max_batch_size=5
- introspection: env-controlled (prod=false, dev=true)

docker-compose.yml:
- Mount portal-shell/public/pq-manifest.json as read-only volume
- Add APOLLO_REQUIRE_PQ_MANIFEST + APOLLO_ROUTER_INTROSPECTION env vars
- Dev defaults preserve current behavior (manifest optional)

entrypoint.sh:
- Pre-start check: if require_manifest=true, fail fast when manifest missing
- Dev mode: warn but continue when manifest absent

Production enables strict mode via env:
  APOLLO_REQUIRE_PQ_MANIFEST=true
  APOLLO_ROUTER_INTROSPECTION=false

infra/docker-compose.yml

@@ -145,7 +145,7 @@ services:
   debezium-connect:
     image: quay.io/debezium/connect:2.7
     container_name: edu-debezium
-    profiles: ["default", "p3", "p4", "p5", "p6"]
+    profiles: ["p3", "p4", "p5", "p6"]
     restart: unless-stopped
     depends_on:
       kafka:
@@ -296,7 +296,8 @@ services:
         condition: service_started
   config-service:
     build:
-      context: ../services/config-service
+      context: ..
+      dockerfile: services/config-service/Dockerfile
     container_name: edu-config-service
     profiles: ["p3", "p4", "p5", "p6"]
     restart: unless-stopped
@@ -330,22 +331,22 @@ services:
     environment:
       ROUTER_AUTH_SECRET: ${ROUTER_AUTH_SECRET:-dev-router-secret}
       APOLLO_ELV2_LICENSE: accept
+      # v2.1 M3 安全加固开关（生产设为 true，开发默认 false）
+      APOLLO_REQUIRE_PQ_MANIFEST: ${APOLLO_REQUIRE_PQ_MANIFEST:-false}
+      APOLLO_ROUTER_INTROSPECTION: ${APOLLO_ROUTER_INTROSPECTION:-true}
     ports:
       - "3000:3000"
       - "8088:8088"
-    depends_on:
-      - iam
-      - core-edu
-      - content
-      - msg
-      - ai
-      - data-ana
-      - config-service
+    volumes:
+      # PQ manifest 从 portal-shell 构建产物挂载（v2.1 M3）
+      # 关联：portal-shell spec §4.2、§4.3
+      - ../apps/portal-shell/public/pq-manifest.json:/etc/apollo-router/pq-manifest.json:ro
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8088/health"]
       interval: 15s
       timeout: 5s
       retries: 5
+      start_period: 30s
   # ============================================================
   # portal-shell - 统一前端壳（v2.1 M8）
   # Modular Monolith + 微内核架构，端口 4010（避开 4000-4003 portal 段）