feat(msg): graphql subgraph with dataloader for notification/template

- GraphQLModule: Apollo Federation 2 at /graphql

- Notification/NotificationTemplate @key with @ResolveReference

- RouterAuthGuard: validate Router-Authorization header (ADR-036)

- batchFindByIds added to notifications and templates repositories

services/msg/src/notifications/notifications.repository.ts

@@ -39,6 +39,15 @@ export async function findById(id: string): Promise<Notification | undefined> {
   return row;
 }
 
+/**
+ * 批量查询通知（DataLoader @key 解析器使用，ADR-035）
+ */
+export async function batchFindByIds(ids: string[]): Promise<Notification[]> {
+  if (ids.length === 0) return [];
+  const db = getDb();
+  return db.select().from(notifications).where(inArray(notifications.id, ids));
+}
+
 export async function findByEventId(
   eventId: string,
 ): Promise<Notification | undefined> {