feat(msg): graphql subgraph with dataloader for notification/template

- GraphQLModule: Apollo Federation 2 at /graphql

- Notification/NotificationTemplate @key with @ResolveReference

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- batchFindByIds added to notifications and templates repositories

services/msg/src/app.module.ts

@@ -9,6 +9,8 @@ import { HealthModule } from "./shared/health/health.module.js";
 import { PermissionGuard } from "./middleware/permission.guard.js";
 import { LifecycleService } from "./shared/lifecycle/lifecycle.service.js";
 import { KafkaConsumerService } from "./shared/kafka/kafka.consumer.js";
+import { GraphqlModule } from "./graphql/graphql.module.js";
+import { RouterAuthGuard } from "./graphql/router-auth.guard.js";
 
 /**
  * AppModule —— msg 服务根模块。
@@ -37,9 +39,11 @@ import { KafkaConsumerService } from "./shared/kafka/kafka.consumer.js";
     AnnouncementsModule,
     GrpcModule,
     HealthModule,
+    GraphqlModule,
   ],
   providers: [
     { provide: APP_GUARD, useClass: PermissionGuard },
+    { provide: APP_GUARD, useClass: RouterAuthGuard },
     LifecycleService,
     KafkaConsumerService,
   ],